1Password debuts Credential Broker to release secrets only when needed.
Article excerpt
Highlighted: the sentence this signal was extracted from
1Password debuts Credential Broker to release secrets only when needed. 1Password LLC today announced the launch of 1Password Credential Broker, a new product that hands out credentials, tokens and federated access from its vaults to trusted requesters only when they are needed, rather than leaving secrets scattered across apps, code and pipelines. The launch reflects how credential use inside enterprises has changed. For two decades 1Password has stored the logins people type into a browser. Now machines need them too. In 2026, software does much of the requesting now. Continuous integration/continuous deployment or CI/CD pipelines, cloud workloads, service accounts and artificial intelligence agents all pull credentials to do their jobs. To make that work, teams paste the secrets into repositories, drop them in config files, or leave them in environment variables, never to be cleaned up. Credential Broker leaves the secret in the vault. It verifies who is asking, then releases only the one credential that the requester is cleared for. In the GitHub Actions flow, a workflow sends identity signals to 1Password, which matches them against a configured workload identity before handing over the credential. The credential itself is never copied into the pipeline or an environment file. Fewer copies mean fewer places a static secret can leak or linger after it is needed...
Keep reading with a free account
The rest of this article, and every signal for 1Password, is in your free account.
