Sometime last spring, mid-debugging session, I pasted a client’s live Shopify API key into a ChatGPT window. I wanted help parsing a webhook payload, the fastest path from stuck to unstuck ran straight through the chat box, and about thirty seconds after hitting enter I understood exactly what I’d done. The next hour went to rotating that key plus two downstream credentials across three services, and quietly rewriting my own checklist about never, ever doing that again. The gross part is how normal it felt in the moment.
That specific flavor of mistake is what 1Password says it’s eliminating. This week, 1Password for Agents showed up on Product Hunt, and the pitch is that AI agents can sign in to services on your behalf without the password ever being exposed to the agent. Pricing for the agent-facing tiers wasn’t announced. I’ve had basically zero hands-on time with it. So treat this as a first look, not a verdict, because honesty about limited hands-on time beats fake confidence about a feature that’s days old.
If the whole agent wave is new to you, our primer on the agentic workforce is the fastest catch-up, and our no-hype playbook on AI automation for small businesses covers the practical side. This post is the narrow question underneath both: when software starts logging into other software for you, who’s holding the keys?
What 1Password for Agents actually claims
The claim, as far as launch materials go: an agent needs to sign in to a service, it requests access through 1Password, and 1Password brokers the sign-in. The agent ends up with working access while the actual credential stays sealed in your vault. 1Password pitches this as agent sign-in with zero-knowledge credentials, which fits how their architecture has always been described, and the design goal is presumably that the agent gets a session or scoped credential rather than the plaintext password.
That “presumably” is doing real work in that sentence. I haven’t verified the mechanics, and I’d want to read the actual docs before betting an operations stack on my summary. Launch-week claims and shipping reality have a way of differing.
Here’s why this matters for small businesses specifically. The current defaults for agent credentials are ugly. In n8n you paste a secret into a credential field once and then mostly forget it exists (encrypted at rest, sure, but you typed the thing). In Zapier you click “connect” and trust the OAuth flow. In custom agent code, secrets sit in .env files or, if you’re a normal human being, in a Notion doc titled “passwords final v3 REAL.” I’ve seen that doc. You’ve probably seen that doc. If you’re still weighing platforms, our comparison of the big automation platforms gets into how each one handles credentials differently.
And agents are now being pointed at tools that never bothered building OAuth in the first place. Banking portals. Hosting panels. The industry SaaS your supplier forces on you that was last updated in 2011. Password-only logins are exactly where agents are heading, which is exactly where pasting secrets around gets scariest.
The real risk isn’t the leak. It’s sprawl.
A few months ago I did a security-lite review for a nine-person logistics company. Nothing fancy, just an inventory. They had 23 active Zapier connections and 6 n8n credentials. Of those 29, five had no owner anyone could name, and two pointed at a shipping dashboard they’d stopped paying for in March. Nobody noticed, because turns out the workflows touching it had quietly broken months earlier and everyone assumed someone else was on it.
That’s the pattern I keep running into, and it’s why I’m more interested in this launch than I’d normally be for a password manager feature. Zero-knowledge agent sign-in fixes the exposure half of the problem. It does nothing about the authorization half. If an agent can request sign-in to your bank portal, the interesting question isn’t whether it sees the password. It’s whether it should be able to act as you at all, who approved that, and who’s reviewing it next quarter.
Every automation you ship adds a standing credential to your business. Agents make this worse, because unlike a scheduled trigger, agents are expected to decide and act. We wrote a whole piece on why your AI agent strategy can quietly become a security liability, and the short version is that access adds up faster than oversight.
Maybe I’m being dramatic. Plenty of small teams run dozens of automations with zero audits and nothing terrible happens. “Nothing bad has happened yet” is a strategy right up until the morning it isn’t, and I say that as someone who once spent a very sheepish Tuesday explaining a stale-credential incident to a client. It took us four hours to even find which workflow held the thing. I still don’t have a good story for that.
What it costs, and what to ask sales
Now the awkward part: pricing for the agent-facing tiers wasn’t announced, at least as of writing. Nobody outside 1Password knows what an “agent seat” costs, or whether it’s even priced per agent rather than per human. So the honest answer to “what does this cost my small business per month” is, for the agent piece, unknown. I’d treat any blog confidently quoting agent pricing this week with suspicion, mine included.
The base product is a different story. 1Password’s business plans have been around for years, and we pay for 1Password Business for our own small team. Last time I looked it ran somewhere in the single digits per user per month, but pricing moves, so check their site rather than trusting my memory. If you’re already a 1Password Business customer, the smartest move this week costs nothing: open a sales conversation and ask direct questions.
Questions I’d ask, in order:
- Is agent sign-in included in the plan I already pay for, or is it a separate tier? This one answer changes the whole calculus.
- How is an “agent” counted for billing? Per workflow, per platform, per assistant? This is where surprise costs hide.
- Do agent-initiated sign-ins show up in audit logs? I want to see which agent signed in, where, and when. A vague answer here is a red flag.
- Can I scope which vault items an agent can request? The invoicing agent should never be able to ask for the bank login. Scoping is the difference between a vault and a key ring with everything on it.
- What happens when I revoke an agent? Immediate session death, or does access linger somewhere I can’t see?
- Does it work with my actual stack? n8n, Zapier, custom code, whatever you really run. If it only works with a proprietary agent product, the value changes a lot.
As for what task this actually removes: it takes over the copy-paste dance of getting secrets into agent configs, the shared logins over Slack, and the rotation scramble when someone leaves. That’s a real operations task, not a fake one. Whether it’s worth paying for depends entirely on a pricing answer nobody has yet.
A 3-step audit before you spend anything
Before you email 1Password, figure out whether you actually need this. It takes an afternoon, costs nothing, and honestly the results are useful no matter what you decide about this feature.
Step 1: Count where your secrets actually live
Open your Zapier connections page and count. Open n8n’s credentials screen and count. Search your team drive and Slack for “password,” and grep your repos if you have them. Write the number down. In my experience it’s always higher than the owner expects, and the reaction is always the same half-laugh, half-wince.
Step 2: Sort them by auth type
OAuth connections (Google, Slack, HubSpot, most modern SaaS) are scoped and revocable, and the platform holds the token, not you. Those are the low-drama ones. The high-drama ones are raw username-and-password logins to tools without OAuth: banks, hosting panels, legacy industry software. If your list from Step 1 is 90 percent OAuth, you need this feature less urgently than you think. If it’s full of plaintext passwords, pay attention.
Step 3: Name an owner for every credential
For each item from Step 1, write down one human name. Not a role, a name. If you can’t, that’s your first fix, and no new tool solves it for you. This is the step that would have caught the two dead-dashboard connections at my logistics client, and it’s the least fun and most valuable part of the whole exercise.
Then the rough decision rule: under five automations, all OAuth, no agents touching financial tools? File this under “watch.” Agents already logging into password-only systems, especially anything involving money? Take the sales call the same week pricing drops.
Where I land, for now
Cautiously interested, which for a launch-week feature is about as enthusiastic as I get. The thing that tips me positive is the source: this comes from a company whose whole business has been credential handling for years, not from an agent startup bolting a vault on as a checkbox feature. That pedigree counts for something in a category where “trust us” is pretty much the product.
What I want to see before calling it good: real pricing, audit logs that answer the questions above, and integrations that work with the messy stacks small businesses actually run.
I’ve been wrong about this category before, and it’s worth admitting. I genuinely believed that browser autofill plus shared vaults would kill the “passwords final v3” Notion doc years ago. It didn’t. Tools rarely fix habits, and I don’t have a clean explanation for why this time would be different.
So, if you already pay for 1Password Business, ask sales this week and see what they say. If your business doesn’t use any password manager at all, that’s the purchase to make first, agent feature or not. And if you’ve already got agents logging into things for you, I’d genuinely like to hear how you’re handling credentials. Drop me a line.
Talk soon,
Damian
