1Password for Claude zero-exposure: login and OTP without sharing secrets

When Claude or Claude in Chrome hits a login wall, teams often fall into one of three habits:

📑Table of Contents

1. What zero-exposure changes
2. Setup requirements and connection steps
3. Agentic Mode and operational caveats
4. Adoption checklist and next actions
5. FAQ
6. Summary
7. Author Perspective

• Paste a password or OTP into chat
• Fall back to manual login
• Hand the agent a raw .env snippet

All three keep work moving, and all three widen the secret exposure surface.

On 2026-07-16, 1Password announced 1Password for Claude. The design goal is explicit.

Claude can complete browser tasks that need sign-in, while passwords and one-time codes never enter the model context or memory. After biometric approval, 1Password injects credentials into the page.

What this article covers

This article covers:

• Requirements and connection steps
• Supported vs unsupported item types
• Agentic Mode and operational caveats
• An adoption checklist

Sources used for this write-up:

• Official blog
• Setup docs
• Security docs
• Anthropic Support
• Independent coverage

---

Related design layer

The same separation principle appears in Claude Code sandbox choices and Claude Code security setup: credential handling is only one layer. Post-login actions remain an agent-policy problem.

---

What zero-exposure changes

What changes

Zero-exposure changes who decrypts and types secrets. Claude may request a login item, but it does not read vault values. 1Password remains the source of truth and fills the page after human approval.

That matters because agent failures often come from over-broad permission grants. Pasting into chat is reliable and leaves residue in history, logs, and reused prompts. Manual login is safer and breaks multi-step agent runs. Zero-exposure inserts a credential-injection layer between those extremes.

---

Typical flow

1. Claude starts a browser action that needs sign-in
2. 1Password shows the requested item and reason
3. The user approves with Touch ID or account credentials
4. 1Password injects username / password / OTP over a protected channel
5. Claude only receives item metadata and success/failure status

---

Access lifetime

Official security guidance scopes access to the current task. There is no standing vault access. Access ends when the session ends or a hard time bound expires, and failed fills are cleared before control returns. ZDNET independently confirms per-task re-approval and no standing access across tasks.

Bottom line: this is not “teach Claude your password.” It is “let the page receive a login without showing the secret to Claude.” Start with one low-risk pilot site only.

---

Setup requirements and connection steps

Current public requirements are Mac-first. You need the 1Password Mac app, the 1Password browser extension, Claude Desktop, and Claude in Chrome. Do not plan a Windows-first rollout on the current docs.

Boundary table

Item	Current boundary
OS	Mac only
1Password app / extension	8.12.28 or later
1Password plans	individual / family / business
Claude side	Desktop + Claude in Chrome; documented as beta on paid plans (Pro / Max / Team / Enterprise)
Supported items	Login username / password / OTP (TOTP)
Unsupported	payment cards / identity / passkeys (official)
Org controls	1Password Business agentic autofill policy; Claude Team/Enterprise owner enablement (off by default)

---

Sources for requirements

Sources: 1Password Support setup, Anthropic Support (as of July 2026).

---

Shortest connection path

1. Update 1Password for Mac and the browser extension to 8.12.28+
2. Install Claude Desktop and Claude in Chrome
3. On Business accounts, enable Allow AI agents to autofill for users under Policies → Sharing and permissions
4. On Claude Team/Enterprise, have an Owner enable Password managers in organization settings
5. In Claude Desktop: Customize → Connectors → 1Password Connect, then approve with Touch ID
6. Run one low-risk task only (for example, check a recent order)

Social logins can be flaky. Passkeys are not supported yet. Do not use this path for card checkout or identity forms.

---

Agentic Mode and operational caveats

How Agentic Mode behaves

Agentic Mode locks the 1Password extension UI when a compatible agent controls the browser. Only explicitly approved login/OTP fills remain reachable.

Key points:

• On by default even if 1Password for Claude is not connected
• Still reduces vault UI exposure during agent control without connector setup
• Cancel a session by closing Claude’s tab group (setup docs)
• Disconnect via Customize → Connectors → Disconnect next to 1Password

---

Official hard boundaries

Official security docs also state hard boundaries:

• Secret-bearing traffic stays on the Mac and uses E2E mutual authentication between desktop app and extension
• A privileged attacker who fully controls the machine is outside the product boundary
• Site-side handling after submit and post-login agent behavior are outside 1Password’s guarantee

---

Residual sessions and adjacent threat layers

ZDNET highlights a practical residual risk: site cookie sessions may remain after the agent task. If the browser stays logged in, a human or later task can reuse that session. Decide logout policy before enabling high-privilege sites.

Credential injection does not replace other agent-security layers. See also GhostApproval and Ghostcommit defenses for approval-UI bypass and image-channel secret exfiltration.

---

Adoption checklist and next actions

The useful post-read action is not “install everything.” It is drawing an allow/deny list.

Comparison axis

Approach	Secret exposure	Operator cost	Best fit
Paste password into chat	High residual risk in chat/logs	Low	Emergency one-offs only
Manual login fallback	Secrets stay with user/vault	High	High-privilege and production consoles
1Password injection (zero-exposure)	Not given to the model; page-only fill	Medium (per-task approval)	Login + OTP browser chores

Sources: official blog/support docs plus ZDNET operational notes (July 2026).

---

Checklist

• ✓ Mac + 1Password 8.12.28+ + Claude Desktop + Claude in Chrome
• ✓ 1Password plan is individual, family, or business
• ✓ Business policy for agentic autofill is enabled when required
• ✓ Claude Team/Enterprise owner enablement is complete when required
• ✓ Connector pairing works on one low-risk site
• ✓ Card checkout, passkey-only flows, and high-privilege admin consoles are on a deny list
• ✓ Post-task logout policy is explicit (cookie residue)
• ✓ Team knows how to close the Claude tab group and disconnect

---

Recommended order

Recommended order:

1. Confirm platform requirements
2. Start with one low-risk pilot task end-to-end
3. Ask admins for policy enablement when needed
4. Publish a deny list
5. Review overall secret handling alongside sandbox design and password-manager strategy

---

FAQ

Q1. Are passwords or OTPs sent to Claude or Anthropic?

Official docs state the following:

• Passwords and one-time codes do not enter Claude context/memory or Anthropic systems
• Claude sees metadata and outcome status
• 1Password performs the fill after per-task human approval

---

Q2. Can Windows or Team plans use this immediately?

Public setup gates:

• Mac-first platform requirements
• Claude Team/Enterprise requires owner enablement and defaults to off
• 1Password Business requires the agentic autofill policy
• Confirm both plan gates before a rollout

---

Q3. What is unsupported, and how far should you trust it?

Current boundaries:

• Cards, identity items, and passkeys are unsupported
• Social login may be unstable
• Login + TOTP chores are the intended lane
• Post-login browsing, payments, and production consoles still depend on agent safety settings and human judgment
• Include logout decisions for residual cookies

---

Q4. Do you need to disable Agentic Mode?

• No
• Agentic Mode is an extra lock that turns on during agent browser control, even without connector setup
• Close Claude’s tab group to cancel a run

---

Related articles:

• Claude Code Harness Explained: Model, Inner Loop, Outer Config
• How to write Claude Code Skills: official rules and real examples
• Codex Plugin for Claude Code Review and Rescue Setup

Summary

1Password for Claude is a credential layer with human approval, not a way to store secrets inside the model. Zero-exposure keeps values out of Claude; Agentic Mode reduces vault UI exposure during agent control.

The product is also bounded: Mac-first, Login/OTP only, org policy gates, residual browser sessions, and no guarantee for post-login agent behavior. Adoption quality depends on allow/deny decisions more than on feature hype. Start with one low-risk task, then publish the deny list.

---

Author Perspective

For agent workflows, decide exposure surface before convenience.

• Chat paste is reproducible and log-heavy
• Manual fallback is safer and interrupts continuous runs
• 1Password for Claude fits the narrow Login + OTP band when per-task approval cost is acceptable

Treating cards, passkeys, or high-privilege admin consoles as in-scope sets the wrong bar. Separate two questions: does the secret enter the model, and what may the agent do after login? A low-risk pilot is a practical evaluation entry point; high-privilege admin consoles stay out of scope until deny/allow rules are explicit.

Related new article:

• Ledger Agent Stack for AI Agents: Propose-Only Wallets with Hardware Approval – This published update adds current operational context for 1Password for Claude zero-exposure: login and OTP without sharing secrets.