1Password

axiom.ai integrates with 1Password as a login credential provider. Instead of storing a username, password, or 2FA secret in Axiom, you keep them in your own 1Password vault and Axiom retrieves them at runtime to sign in to a site, including completing two-factor authentication automatically.

Axiom only ever stores a reference to the vault item and a service account token. It never holds the actual username, password, or 2FA secret.

This page covers 1Password-specific setup. For the full picture of how login credentials work and the steps that use them, see Log in with saved credentials; for the two-factor authentication flow, see Log in with 2FA.

Create a vault for Axiom

Service accounts cannot read items in a personal vault, so store the credentials you want to automate in a dedicated vault (for example, one named "Axiom"). Add an item for each login.

If you are using an auehtneticator app with this credential, make sure to add its one-time password (2FA) field too.

Create a service account token

A service account token gives Axiom read access to the vault.

1. In 1Password, click Developer in the sidebar.
2. Open the Service Account tab and add a new service account.
3. Select the vault you created so the service account can read it.
4. Copy the token that appears. It's shown only once and can't be retrieved later, so save it somewhere safe before you leave the page.

Add the credential in Axiom

Open Login credentials from the dashboard sidebar and add a credential with the 1Password provider:

• Item reference — the op:// URI for the item, in the format op://vault-name/item-name (for example op://Axiom/GitHub).
• Service account token — the token you copied above.

When editing the credential later, leave the token blank to keep the existing one.

Use it in an automation

Once saved, a 1Password credential works exactly like a built-in Axiom one. Select it in the Log in with credentials and Generate authenticator code steps. At runtime Axiom calls the 1Password API to read the item, fills the username and password, and generates the current 2FA code from the item's one-time password field.

For the full unattended-login recipe, see Log in with 2FA.