OpenClaw + 1Password

Prerequisites

• OpenClaw running (see our deployment guide)
• A 1Password account (any plan including free)
• 1Password CLI installed (optional but recommended)

Step 1: Create a 1Password Connect Server

1. Sign in to your 1Password account
2. Go to Developer Tools → 1Password Connect
3. Click Create a Connect Server
4. Name it (e.g., "OpenClaw")
5. Select the vaults to share with OpenClaw
6. Click Create
7. Download the 1password-credentials.json file

Step 2: Deploy Connect Server

Option A: Docker (recommended)

# docker-compose.yml
services:
  op-connect:
    image: 1password/connect-api:latest
    ports:
      - "8080:8080"
    volumes:
      - ./1password-credentials.json:/home/opuser/.op/1password-credentials.json
      - op-data:/home/opuser/.op/data
    restart: unless-stopped

volumes:
  op-data:

Start the server:

docker compose up -d op-connect

Option B: 1Password CLI

# Install on Linux
curl -sS https://downloads.1password.com/linux/debian/amd64/stable/1password-cli-amd64.deb -o op.deb
sudo dpkg -i op.deb

# Sign in
op signin

Step 3: Create an Access Token

1. In 1Password Developer Tools, go to your Connect Server
2. Click Create Access Token
3. Name it "OpenClaw Integration"
4. Set expiration (or leave for 1 year default)
5. Copy the token immediately (shown only once)

Configuration

Add the 1Password integration to your OpenClaw config:

# In your openclaw config
secrets:
  provider: op
  
integrations:
  onepassword:
    enabled: true
    connect_url: "http://op-connect:8080"
    token: "ops_token_xxxxxxxx"  # Your access token

Or via environment variables in your docker-compose.yml:

environment:
  - OP_CONNECT_HOST=http://op-connect:8080
  - OP_CONNECT_TOKEN=ops_token_xxxxxxxx

Step 4: Verify Connection

Test the integration by asking OpenClaw to retrieve a secret:

"Get my API key from 1Password"
"List items in my Private vault"
"What's the password for AWS?"

Check the Connect server is running:

curl http://localhost:8080/v1/vaults

Security Best Practices

1. Least privilege: Only share vaults OpenClaw needs
2. Rotate tokens: Create new tokens periodically
3. Audit access: Review token usage in 1Password
4. Network isolation: Don't expose Connect server publicly
5. Separate vaults: Use dedicated vaults for automation secrets

Common Issues

Token invalid: Access tokens can be revoked. Check in 1Password Developer Tools and regenerate if needed.

Vault not found: Ensure the vault is shared with your Connect Server during setup. You can edit access later.

Connection refused: Verify the Connect server is running: docker compose ps op-connect. Check logs with docker compose logs op-connect.