# Next-generation automated provisioning, without compromising zero-knowledge security

DevFeed: [Next-generation automated provisioning, without compromising zero-knowledge security](<https://devfeed.tech/articles/next-generation-automated-provisioning-without-compromising-zero-knowledge-security-1941.md>)

Original publisher: [Read original article](<https://1password.com/blog/next-generation-automated-provisioning>)

Author: info@1password.com (Chas Lynch)

Published: 2026-03-17T00:00:00Z

Content type: article

Language: en

Sources: [Blog on 1Password Blog](<https://devfeed.tech/sources/blog-on-1password-blog.md>)

Topics: [Cryptography](<https://devfeed.tech/topics/cryptography.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [automation](<https://devfeed.tech/tags/automation.md>), [building-1password](<https://devfeed.tech/tags/building-1password.md>), [cryptographic](<https://devfeed.tech/tags/cryptographic.md>), [cryptography](<https://devfeed.tech/tags/cryptography.md>), [developers](<https://devfeed.tech/tags/developers.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [identity](<https://devfeed.tech/tags/identity.md>), [saas](<https://devfeed.tech/tags/saas.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>), [zero-knowledge](<https://devfeed.tech/tags/zero-knowledge.md>)

## AI overview

1Password describes automated user provisioning in a zero-knowledge system, focusing on the risks of trusting a server to distribute or replace cryptographic keys.

## Source excerpt

Automating user provisioning sounds simple, until you remember everything that provisioning really touches. For most SaaS products, SCIM is "just" user and group lifecycle management. Your identity provider calls an API, accounts get created, access is assigned, and offboarding removes it. But for 1Password, provisioning intersects with something far more sensitive: the cryptographic foundation that protects every vault. 1Password is end-to-end encrypted by design. We do not hold your encryption keys and cannot see your vault contents. This provides a powerful guarantee that even if 1Password's servers were to be compromised, your data would remain unreadable, as the keys required to decrypt it are never accessible to us. That model is why customers trust 1Password with their most sensitive credentials, but it also makes automation genuinely hard. After all, how can we automate provisioning inside a zero-knowledge platform, without reintroducing trust in the server? That is the problem Automated Provisioning hosted by 1Password solves, and it's why our approach is fundamentally different from other provisioning options on the market. The hidden tradeoff in "hosted SCIM" Most hosted provisioning solutions are built on a straightforward assumption: the service performing provisioning can be trusted to manage the system state, distribute keys, and act as an authority. This is what makes many SCIM implementations "easy" to host, but that assumption quickly breaks down in a zero-knowledge system. If a server can create, hand out, or swap cryptographic keys without independent verification, then clients are ultimately trusting the server as a source of truth. Even if the threat is theoretical, the trust model is real, and even a theoretical gap matters for 1Password. The problem Public key cryptography is built around two keys: a private key that must remain secret, and a public key that can be shared freely. When you share something securely, you encrypt it using the rec