> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 1Password (Groups)

*This is the 1Password (Groups Only) connector: it authenticates with a 1Password service account and provides read-only sync of 1Password users and groups. For full sync plus provisioning of users, groups, and roles, use [1Password (Admin)](/integrations/library/1password/1password-admin) instead. Both connectors run through the Lumos On-Premise Agent using the 1Password CLI.*

## After this article

You will be able to connect 1Password to Lumos via the On-Premise Agent to sync 1Password users and their group memberships for visibility and Access Reviews.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User account records |
| Groups | Permission | Yes | No | Groups in 1Password and their membership |
| Roles | Permission | No | No | Not synced by this method (use the Admin connector for roles) |

This method is read-only. It doesn't provision users, groups, or roles, and it doesn't deprovision. For provisioning and role visibility, use the [1Password (Admin)](/integrations/library/1password/1password-admin) connector.

## Required plan and roles

* **1Password plan:** a 1Password **Business or Enterprise** account.
* **1Password role:** administrative access to 1Password is required to create the service account.
* **Host prerequisites:** a Lumos On-Premise Agent (see the On-Premise Agent guide in the Lumos Developer Docs at app.lumosidentity.com/docs), Python 3.6+, and the 1Password CLI (`op`) version 2.18+ installed and on PATH for the service account that runs the agent, with outbound network access to 1Password's API.
* **Credentials and scope:** read-only. This method uses a 1Password **Service Account token**. The connector receives the token from the Lumos UI and sets `OP_SERVICE_ACCOUNT_TOKEN` in the CLI subprocess automatically. You don't set it as a host environment variable.

## Instructions

**Phase 1: Prepare the On-Premise Agent host**

1. Set up the Lumos On-Premise Agent following the Lumos Developer Docs.
2. Install the 1Password CLI (`op`) on the agent host and verify it's on PATH for the service account that runs the Lumos agent service, not just your interactive shell.

**Phase 2: Create a Service Account in 1Password**

1. Create a Service Account at `https://[DomainName].1password.com/developer-tools/infrastructure-secrets/serviceaccount`.
2. Save the generated service account token.

**Phase 3: Connect in Lumos**

1. Click the 1Password card in your Lumos integrations (reconnect an existing card or add a new one) and choose the **Groups** (service account) method.
2. Enter the service account token in the Lumos UI. You don't need to set it as an environment variable on the agent host. Lumos passes it to the agent, which sets it in the CLI subprocess automatically.
3. Follow the on-screen instructions to enable 1Password on-premise and click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Clicking Connect appears to do nothing.** Check that the on-prem agent is running and healthy. Connection errors from the agent are surfaced in the UI, and a crashed agent (stale heartbeat) will prevent the connection from completing.

**`op` CLI not found even though it's installed.** The Lumos agent service runs with its own PATH, which differs from your interactive shell. Install the CLI so it's on PATH for the service account that runs the agent service.

**Vault provisioning isn't available.** This connector is read-only and neither 1Password connector supports direct vault provisioning. Pre-assign vaults to 1Password groups, then use the [1Password (Admin)](/integrations/library/1password/1password-admin) connector to provision users into those groups.