Connect & Integrate 1Password

Introduction

This guide explains how to connect YeshID to your 1Password Business account. The connection uses 1Password's SCIM interface, so YeshID can keep your 1Password membership in step with your onboarding and offboarding workflows instead of you managing it by hand.

Important: 1Password has replaced the self-hosted SCIM bridge with automated provisioning, hosted by 1Password. New setups no longer deploy or maintain any infrastructure. If you already run a SCIM bridge, it still works with YeshID, and there is a section at the end of this guide covering it.

What YeshID can do with 1Password

Once connected, YeshID can:

• Import your 1Password users and groups, and keep them up to date

• Create users

• Update user attributes

• Suspend (deactivate) users

• Delete users

• Add users to groups

Two actions are not supported today: removing a user from a group, and reactivating a user who has been suspended. Both still need to be done in 1Password.

Prerequisites

• You are in the Owners or Administrators group of a 1Password Business account. Enterprise is not required.

• You have admin access in YeshID to add and connect applications.

• The email domains of your 1Password members are in your account's allowed domains list. 1Password does not support public domains such as gmail.com for provisioning.

Steps

1. Turn on automated provisioning in 1Password

1. Sign in at start.1password.com.

2. Go to Integrations ▸ Automated User Provisioning.

3. Select Set up hosted provisioning, then Start setup. If you currently run a SCIM bridge, this reads Switch to hosted provisioning instead.

4. 1Password asks which identity provider you use, and lists Entra ID, JumpCloud, Okta, and OneLogin. Pick whichever fits your environment. The setup issues a standard SCIM URL and bearer token, and those work with YeshID regardless of which option you choose.

5. Save the credentials before you leave the page. The bearer token is not shown again.

6. Leave Provisioning turned on. If it is switched off, 1Password rejects every request from YeshID.

2. Add 1Password in YeshID

1. In YeshID, go to the Connect & Integrate page.

2. Find 1Password in the application catalog.

3. Choose the SCIM setup option.

3. Enter your SCIM URL

Use the URL exactly as 1Password showed it to you, with no trailing slash. It is specific to your account's data region:

Paste it into the SCIM URL field.

4. Enter your bearer token and save

1. Paste the bearer token from step 1 into the Bearer Token field.

2. Select Bearer if you are prompted for an authentication type.

3. Select Save.

YeshID tests the connection and begins importing your 1Password users and groups.

Still running a self-hosted SCIM bridge?

Your existing bridge continues to work. Enter your bridge domain as the SCIM URL, for example https://scim.example.com, along with the bearer token from Integrations ▸ Automated User Provisioning.

When you are ready to move to hosted provisioning, follow 1Password's migration guide, update the SCIM URL in YeshID to the hosted URL for your region, and then decommission the bridge infrastructure. Note that migrating is one way: once an account switches to hosted provisioning, it cannot go back to a self-hosted bridge.

FAQ and troubleshooting

I get "405 Method Not Allowed". The SCIM URL is wrong. This is most often caused by entering a URL from api.1password.com. Those are 1Password's own authentication endpoints, not SCIM, and they reject provisioning requests. Use the provisioning.1password.* URL for your region, or your SCIM bridge domain.

I get "403 Forbidden" with a message about provisioning being off. Provisioning is switched off in 1Password. Sign in at start.1password.com, go to Integrations ▸ Automated User Provisioning, turn provisioning back on, and retry.

I get "401 Authorization failure. The authorization header is invalid or missing." The bearer token is wrong, expired, or was regenerated. Generate a fresh token in 1Password and paste it into YeshID again.

Do I need 1Password Enterprise? No. Automated provisioning is included with 1Password Business.

YeshID is not in 1Password's list of supported identity providers. Does the integration still work? Yes. That list reflects which providers 1Password publishes setup guides for. The credentials it issues are a standard SCIM URL and bearer token, which is what YeshID uses.

Do I still need to deploy a SCIM bridge? No. Hosted provisioning replaces it, and there is no server to run or maintain.

Can YeshID remove someone from a 1Password group during offboarding? Not currently. YeshID can add users to groups, suspend them, and delete them. Removing a specific group membership needs to be done in 1Password.

Which 1Password accounts get imported? All members of the 1Password account the SCIM credentials belong to, along with the groups they belong to.