Skip to main content
Connect a scoped 1Password service account to use Login items from Figranium’s dedicated vault in task flows, and review which credential data Figranium stores locally.

​
Create a service account

Create a dedicated service account in 1Password and give it access only to the custom vault Figranium uses. The service account token is shown once, so save it securely before leaving the creation flow.
1

Open the service-account setup

Sign in to 1Password.com and open the service-account creation wizard. You need permission in your 1Password account to create service accounts.
2

Grant access to the Figranium vault

Figranium uses a custom vault named Figranium. If you want Figranium to create the vault when it cannot find an accessible one, allow the service account to create vaults. Otherwise, create the Figranium vault first and select it for the service account. Do not use a built-in Personal, Private, Employee, or default Shared vault, which 1Password service accounts cannot access.
3

Choose item permissions

Grant Read Items to list Login items and retrieve their usernames and passwords. Also grant Write Items if you want to save or update a Login item from the headful browser flow. Sharing permissions are not required. These permissions and vault access cannot be changed after service-account creation.
4

Save the token and connect Figranium

Create the account and immediately save its one-time token in 1Password or another approved secrets manager. Treat it like a password. In Figranium, go to Settings > Connections, enter the token in the 1Password section, and select Connect.
See 1Password’s service-account setup guide and security model. If the account is missing vault access or permissions, create a new service account with the required access. You can rotate or revoke its token if it is exposed. Once connected, select Vault in the sidebar, then open the Passwords tab. Figranium lists available Login items with their titles, website domains, usernames, and vault name. Password values are not displayed on this screen. To disconnect, go to Settings > Connections and select Disconnect. This does not delete Login items from 1Password.

​
Use a Login in a task

Figranium resolves credentials when a task starts. The Login item’s saved website hostname must match the hostname targeted by the variable. Generic variables use the task URL’s exact hostname; explicit variables target the hostname written in the variable name.
  • Use {$password} for the password and {$uname} for the username associated with the task URL’s hostname.
  • To target a specific hostname, use {$passwords.example^com} or {$unames.example^com}. Replace dots in the hostname with ^, for example login.example.com becomes login^example^com.
  • In the task editor, open the Passwords tab in the variable list. Set a task URL to see matching Login passwords, then click or drag an available variable into a field.
If a matching Login item or requested username/password is missing, or multiple items match, the run fails rather than using an empty or ambiguous value. The names password and uname are reserved and can’t be defined as ordinary task variables. Credential values resolved from 1Password are redacted from execution results and logs.

​
Save a Login from the browser

When you submit a password form in a headful browser session, Figranium may offer to save or update a Login item in the Figranium vault. Select Save password to confirm, or Not now to dismiss the prompt. Figranium saves the Login only after you confirm. This flow requires Write Items permission. See Save login credentials. To update or remove Login items themselves, manage them in 1Password. Figranium’s Vault password list shows the available item details but does not display or edit the password value.

​
Local storage and encryption

Figranium can encrypt the saved 1Password service-account configuration and other supported file-backed integration credentials when you configure MASTER_KEY. Without an explicitly configured master key, new file-backed secret writes use plaintext JSON. This does not encrypt every sensitive value in Figranium or database-backed credentials. Figranium stores the connection file and password cache in its local data/ directory. In Docker Compose deployments, this is /app/data in the container and is persisted by the ./data:/app/data volume mapping. See Docker Compose volume persistence. Existing encrypted files remain accessible when their original key is available. If MASTER_KEY is unset, Figranium migrates an encrypted file to plaintext only after successful decryption. It refuses to overwrite encrypted data when the original key is missing or unavailable. Protect the data directory and its backups, and preserve the configured master key across restarts. Setting MASTER_KEY_FILE to a new or empty key file prevents Figranium from decrypting files encrypted with the previous key. The cache uses a separate key: set PASSWORD_CACHE_KEY to derive it from a secret managed outside the data directory, or let Figranium create or reuse data/password_cache.key. The cache is enabled by default. If the optional encrypted local cache cannot be written, password management continues. Set PASSWORD_CACHE_ENABLED=false to bypass the cache and retrieve current values from 1Password. See Configuration. Resolved credentials are used by the task at runtime, but Figranium redacts them from execution results and logs. Disconnecting the 1Password account clears the active cache. Restrict access to the host and data volume, and rotate or revoke the service-account token if it may have been exposed.