1Password Credential Broker is now in public preview

We’re excited to share that 1Password Credential Broker is now in public preview, with support for GitHub Actions and Generic OIDC!

Credential Broker gives every workload its own identity and changes how credentials get to your workloads. Instead of storing long-lived secrets in plaintext .env files, CI/CD pipelines, or configuration files, workloads prove who they are using OIDC and receive only the specific credentials they’re approved to retrieve, only for the duration of the job

The result is an audit trail that shows exactly which workload accessed what, from where, and under which policy, without relying on long-lived secrets or standing access to the vault.
 

What’s in the public preview
 

GitHub Actions

Connect your 1Password Business account to your GitHub organization, create GitHub organization integrations from the admin console, configure trust policies, and securely deliver credentials to your workflows at runtime. No long-lived service account tokens to manage or rotate.

Generic OIDC (beta)

Bring your own OIDC-compliant platform! If your CI/CD platform or workload runtime can issue OIDC tokens, you can use it with Credential Broker. This includes Kubernetes workloads, cloud platforms, AI agent frameworks, and other OIDC-capable environments. Credentials are delivered on-demand based on identity, not embedded in environments, configs, or pipeline definitions.
 

Get started in the docs: https://www.1password.dev/environments/credential-broker

Read the blog post for a deeper look at how Credential Broker works and what’s included in public preview: https://1password.com/blog/1password-credential-broker-public-preview