# Introducing 1Password Credential Broker

DevFeed: [Introducing 1Password Credential Broker](<https://devfeed.tech/articles/introducing-1password-credential-broker-1932.md>)

Original publisher: [Read original article](<https://1password.com/blog/introducing-1password-credential-broker>)

Author: info@1password.com (Jeff Malnick)

Published: 2026-06-15T00:00:00Z

Content type: release

Language: en

Sources: [Blog on 1Password Blog](<https://devfeed.tech/sources/blog-on-1password-blog.md>)

Topics: [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [developers](<https://devfeed.tech/tags/developers.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [identity](<https://devfeed.tech/tags/identity.md>), [policy](<https://devfeed.tech/tags/policy.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [tokens](<https://devfeed.tech/tags/tokens.md>), [unified-access](<https://devfeed.tech/tags/unified-access.md>)

## AI overview

1Password introduces Credential Broker, a runtime credential-brokering service for machine workloads and AI agents. Its initial beta targets GitHub Actions, using workload identity, policy controls, and audit tools to provide credentials only when needed and revoke access afterward.

## Source excerpt

Right now, somewhere in your organization, a service account token is sitting in a CI/CD environment variable with access to your entire cloud environment. The job it was created for got deleted three sprints ago, and nobody knows it's still there. Unfortunately, that's not just a worst case scenario. For many teams it's a byproduct of how they manage credentials today. Someone in your organization creates a token, scopes it broadly to avoid any last-minute permission errors, drops it into a config file or a pipeline environment variable. They assume someone else will track it down to revoke it when the work is done. That assumption is almost always wrong, and the tokens and overprovisioned access accumulate. Machine identities now vastly outnumber human identities across most enterprises, and AI agents are growing faster and are governed less than almost anything else in the stack. The attack surface keeps expanding, and most teams are still managing credentials and access with the same approach they used five years ago. 1Password has spent more than a decade building what we believe is the best credential vault for humans. More than 180,000 businesses trust us to protect their most sensitive credentials and secrets. Now we're extending that same foundation to the machine workloads and AI agents. Introducing 1Password Credential Broker Our new 1Password Credential Broker extends what you can do with 1Password, from storing credentials and secrets to brokering them at runtime: delivering the right credential to the right workload at the moment work actually needs to happen. A machine workload or AI agent shouldn't hold credentials it doesn't currently need. It should prove who it is, get exactly what policy allows, and lose that access when its job is done. 1Password Credential Broker does exactly that, using the same 1Password vault, policy controls, and audit tools your team already relies on. Our initial beta focuses on GitHub Actions, which handles more than 6 b