> ## Documentation Index > Fetch the complete documentation index at: https://figranium.dev/docs/llms.txt > Use this file to discover all available pages before exploring further. # Manage 1Password Logins Securely in Your Figranium Vault > Set up a least-privilege 1Password service account, connect its token, and understand how Figranium stores and encrypts credentials locally. Connect a scoped 1Password service account to use Login items from Figranium's dedicated vault in task flows, and review which credential data Figranium stores locally. ## Create a service account Create a dedicated service account in 1Password and give it access only to the custom vault Figranium uses. The service account token is shown once, so save it securely before leaving the creation flow. **1. Open the service-account setup** Sign in to [1Password.com](https://start.1password.com/signin) and open the [service-account creation wizard](https://start.1password.com/developer-tools/infrastructure-secrets/serviceaccount/?source=dev-portal). You need permission in your 1Password account to create service accounts. **2. Grant access to the Figranium vault** Figranium uses a custom vault named **Figranium**. If you want Figranium to create the vault when it cannot find an accessible one, allow the service account to create vaults. Otherwise, create the Figranium vault first and select it for the service account. Do not use a built-in Personal, Private, Employee, or default Shared vault, which 1Password service accounts cannot access. **3. Choose item permissions** Grant **Read Items** to list Login items and retrieve their usernames and passwords. Also grant **Write Items** if you want to save or update a Login item from the headful browser flow. Sharing permissions are not required. These permissions and vault access cannot be changed after service-account creation. **4. Save the token and connect Figranium** Create the account and immediately save its one-time token in 1Password or another approved secrets manager. Treat it like a password. In Figranium, go to **Settings > Connections**, enter the token in the **1Password** section, and select **Connect**. See 1Password's [service-account setup guide](https://developer.1password.com/docs/service-accounts/get-started/) and [security model](https://developer.1password.com/docs/service-accounts/security/). If the account is missing vault access or permissions, create a new service account with the required access. You can [rotate or revoke its token](https://developer.1password.com/docs/service-accounts/manage-service-accounts/) if it is exposed. Once connected, select **Vault** in the sidebar, then open the **Passwords** tab. Figranium lists available Login items with their titles, website domains, usernames, and vault name. Password values are not displayed on this screen. To disconnect, go to **Settings > Connections** and select **Disconnect**. This does not delete Login items from 1Password. ## Use a Login in a task Figranium resolves credentials when a task starts. The Login item's saved website hostname must match the hostname targeted by the variable. Generic variables use the task URL's exact hostname; explicit variables target the hostname written in the variable name. * Use `{$password}` for the password and `{$uname}` for the username associated with the task URL's hostname. * To target a specific hostname, use `{$passwords.example^com}` or `{$unames.example^com}`. Replace dots in the hostname with `^`, for example `login.example.com` becomes `login^example^com`. * In the task editor, open the **Passwords** tab in the variable list. Set a task URL to see matching Login passwords, then click or drag an available variable into a field. If a matching Login item or requested username/password is missing, or multiple items match, the run fails rather than using an empty or ambiguous value. The names `password` and `uname` are reserved and can't be defined as ordinary task variables. Credential values resolved from 1Password are redacted from execution results and logs. ## Save a Login from the browser When you submit a password form in a headful browser session, Figranium may offer to save or update a Login item in the Figranium vault. Select **Save password** to confirm, or **Not now** to dismiss the prompt. Figranium saves the Login only after you confirm. This flow requires **Write Items** permission. See [Save login credentials](/docs/headful-browser.md#save-login-credentials). To update or remove Login items themselves, manage them in 1Password. Figranium's Vault password list shows the available item details but does not display or edit the password value. ## Local storage and encryption Figranium can encrypt the saved 1Password service-account configuration and other supported file-backed integration credentials when you configure `MASTER_KEY`. Without an explicitly configured master key, new file-backed secret writes use plaintext JSON. This does not encrypt every sensitive value in Figranium or database-backed credentials. Figranium stores the connection file and password cache in its local `data/` directory. In Docker Compose deployments, this is `/app/data` in the container and is persisted by the `./data:/app/data` volume mapping. See [Docker Compose volume persistence](/docs/docker-compose.md#volume-persistence). | Data | File | Protection | | - | - | - | | Service-account token and connection details | `data/onepassword.json` | Plaintext JSON unless `MASTER_KEY` is configured. With encryption enabled, Figranium uses AES-256-GCM envelope encryption and `0600` file permissions. | | Master key for stored secrets | Configured by `MASTER_KEY` and optionally `MASTER_KEY_FILE` | Authenticated encryption key for supported file-backed credentials. Keep the same key available across restarts and migrations. | | Cached Login metadata and password values | `data/password_cache.json` | Encrypted separately with AES-256-GCM. Cache entries expire after 30 minutes for Login metadata and 10 minutes for password values. | | Default password-cache key | `data/password_cache.key` | A randomly generated 32-byte key with `0600` permissions. | Existing encrypted files remain accessible when their original key is available. If `MASTER_KEY` is unset, Figranium migrates an encrypted file to plaintext only after successful decryption. It refuses to overwrite encrypted data when the original key is missing or unavailable. Protect the data directory and its backups, and preserve the configured master key across restarts. Setting `MASTER_KEY_FILE` to a new or empty key file prevents Figranium from decrypting files encrypted with the previous key. The cache uses a separate key: set `PASSWORD_CACHE_KEY` to derive it from a secret managed outside the data directory, or let Figranium create or reuse `data/password_cache.key`. The cache is enabled by default. If the optional encrypted local cache cannot be written, password management continues. Set `PASSWORD_CACHE_ENABLED=false` to bypass the cache and retrieve current values from 1Password. See [Configuration](/docs/configuration.md#feature-flags). Resolved credentials are used by the task at runtime, but Figranium redacts them from execution results and logs. Disconnecting the 1Password account clears the active cache. Restrict access to the host and data volume, and rotate or revoke the service-account token if it may have been exposed. ## Related guides * [Variables](/docs/variables.md) for task variable syntax and examples. * [Headful Browser](/docs/headful-browser.md) to log in to websites and save credentials. * [Configuration](/docs/configuration.md#feature-flags) for password-cache settings. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.