Revoke an AI Agent’s Access to Your 1Password Data

Revoking an AI agent’s access to your 1Password data means stopping its connection and removing any credentials or permissions it used to reach your account. The exact steps depend on whether the agent connected through a 1Password integration, a service account, a shared item, or a credential stored in another app, so check how access was granted before you remove anything.

What You’ll Need

• Access to your 1Password account, ideally as an owner or administrator if this is a work account.
• The name of the agent, integration, service account, or automation that has access.
• Access to the app or platform where you configured the agent, such as its integration settings or secrets manager.
• A safe way to replace any credentials the agent used, if a person or another service still needs them.

Step-by-Step

1. Pause the agent first. In the agent’s own app or automation platform, disable its workflow, scheduled job, or connection. This helps prevent it from continuing to make requests while you revoke access. If you cannot pause it, proceed to revoke access promptly and check activity afterward.
2. Identify every access route. Review the agent’s setup notes and configuration. It may use a 1Password service account token, a Connect server credential, a shared vault or item, a browser extension, or an integration authorized through another service. Do not assume disconnecting one route removes all the others. Record the names of relevant vaults, service accounts, integrations, and items before changing them.
3. Revoke a service account token if one was used. Sign in to the 1Password web app with an account authorized to manage the relevant team or business settings. Open the administrative area for Developer or Service Accounts—the label and location can vary by account type and interface—and locate the service account assigned to the agent. Revoke or delete the token, or remove the service account if it is dedicated to that agent. Confirm the change. If the service account supports other essential automation, remove only the agent’s access or create a replacement credential and update the other systems first.
4. Remove access to a Connect server or other integration. If the agent used 1Password Connect, open the Connect or integration management settings in the account’s administrative console. Revoke the credential or token the agent used and, if appropriate, disable or remove its access to the server. Also check the agent platform for a saved connection and delete or disconnect it there. A token stored in the agent’s settings may remain visible even after it stops working, so remove the saved secret as well.
5. Remove shared vault or item access. If the agent got a credential from a vault or item shared with a person or service, open the relevant vault or item and review its sharing and access settings. Remove the agent’s associated user or service account, or stop sharing the item. For a shared vault, confirm that removing access will not disrupt other team members. If you cannot identify the agent separately, treat the credential as exposed and replace it in the next step.
6. Rotate credentials the agent could have read. Revoking the connection prevents future access through that route, but it does not make passwords, API keys, recovery codes, or other secrets already retrieved by the agent secret again. Change the affected credentials at the services they protect, then update approved users and automations that still need them. Prioritize high-impact credentials and anything the agent could have copied or logged. Do not put replacement secrets into an untrusted agent or its logs.
7. Check for remaining access and activity. Review 1Password’s available activity or audit information and the agent platform’s connection history for recent access. Check for duplicate tokens, another service account, a second shared item, or a separate browser or desktop integration. If your account offers no relevant activity view, confirm directly that the token or account is disabled and test that the agent can no longer retrieve data.
8. Clean up and document. Delete the agent’s stored credentials and configuration from its platform, where safe to do so. Keep a brief record of what you revoked, what credentials you rotated, and when. If this is an organization account, notify the administrator or security contact and follow your organization’s incident process if sensitive data may have been exposed.

Common Mistakes

• Only uninstalling or disabling the agent: This may leave a valid token, service account, or shared vault permission active.
• Revoking a credential without rotating secrets it accessed: A copied password or API key can remain usable independently of 1Password.
• Deleting a shared account used by other systems: Check ownership and dependencies first; use a dedicated credential for each automation where possible.
• Forgetting saved copies: Secrets may also exist in environment variables, deployment settings, logs, local files, or a secrets manager.
• Assuming a failed test proves everything is revoked: The agent may have a second route or cached data. Inspect all integrations and permissions.

Tips

• Give each agent or automation its own dedicated account or token, with access limited to the specific vaults and items it needs.
• Store credentials in a managed secrets store rather than in prompts, source code, or shared configuration files.
• Keep a simple inventory of integrations, token owners, permissions, and the human responsible for each one.
• After revocation, monitor the connected services too. A 1Password change cannot remove copies of data the agent already received.

Troubleshooting

You cannot find the service-account or integration controls: You may be signed in to the wrong account, lack administrator rights, or be using a different 1Password setup. Ask the account owner to check the administrative console, and consult current 1Password help for the specific integration. Do not share your account password to get help.

The agent still retrieves data: Recheck for another token, service account, shared vault, Connect credential, or integration. Make sure you revoked the credential actually configured in the agent, not just a similarly named one. Pause the agent, remove additional routes, and test again.

Other automations stopped working: You may have revoked a shared credential. Identify affected services and give each approved service a separate, limited credential. Do not restore the agent’s access simply to get another workflow working.

You suspect the agent copied sensitive data: Treat the affected secrets as exposed. Rotate them with the services that issued them, review their sign-in or access activity, and contact your organization’s security administrator if applicable. Revoking 1Password access cannot erase copies already made elsewhere.

Frequently Asked Questions

Does disconnecting the agent erase data it already accessed?
No. It stops access through the revoked route, but cannot guarantee deletion of information the agent previously read, cached, logged, or sent elsewhere.

Should I delete the entire service account?
Only if it is dedicated to the agent and no approved process depends on it. Otherwise revoke the agent’s specific token or permissions and verify the remaining services still work.

Do I need to change every password in 1Password?
Not necessarily. Rotate credentials the agent could access, especially those that are sensitive or whose exposure you cannot rule out. Changing unrelated passwords may create avoidable disruption.

Will uninstalling an integration revoke its token?
Not reliably. Remove or revoke the credential in 1Password or the integration’s control panel, and delete the saved connection in the agent platform too.

Can I revoke access if I am not an administrator?
You may be able to stop sharing an item you own, but service-account and organization-level controls may require an administrator. Ask the account owner to revoke access and confirm the result.

Related

• Donkey Kong Arcade vs NES: Gameplay, Graphics, Collecting
• Phantom Blade Zero Phantom Brew?
• Secure XRP Wallet: Custodial vs Self-Custody