Browser Use Tutorial: Connecting 1Password to Let Agents Automatically Fill Passwords and TOTP

Connecting 1Password to Browser Use Cloud lets your agent automatically fill passwords and TOTP codes to sign in and complete web tasks. Store the credentials in a dedicated vault, then give the agent access through a service account.

In this short tutorial, we'll guide you step by step through connecting 1Password to Browser Use and automating a login.

TL;DR

1. Create a vault for your login credentials.
2. Create a service account with read access.
3. Connect to Browser Use using its token.
4. Run the login and verify the authenticated page.

What Is 1Password?

1Password is a password manager that stores login details and other sensitive information. It organizes these records into vaults, so you can keep personal, shared, and automation credentials separate.

A login item holds the username, password, and website for an account. It can also store the setup information used to generate time-based one-time passwords (TOTP), the rotating codes some websites request after your password.

How It Works

Browser Use connects to your vault through a 1Password service account, an identity for software. Its token grants access to the vaults and operations you select. Here, it can read one vault and use its credentials to fill login forms.

Read-only vault access doesn't restrict what the logged-in website account can do. Entered credentials also remain accessible to the page and browser/CDP tools.

Use the service-account connection for API or dashboard automation with predefined vault access, as we'll do here. Choose the dashboard's personal "Agentic Autofill" option when you want to approve login access through your personal 1Password account.

We'll use The Internet, a public test site with a login form and a protected page. Its shared username and password let you test the connection without using a private account. You can see both on its login page.

Create a Vault

Start with a vault containing only these test credentials.

Open your vaults on 1Password.com and click the "+" button beside "VAULTS". In the "Create Vault" dialog, enter Browser Use Demo in the "Vault Name" field, then click "Create". The vault instructions also cover creating one from the "Home" page or desktop app.

Select the new vault in the sidebar. Click "New Item", choose "Login", and enter The Internet as the title. Fill in these values:

Check that the vault selector at the bottom shows Browser Use Demo, then click "Save".

Keep the website field accurate. In V4, Browser Use derives the credential's permitted typing hosts from the item's saved websites. A missing website can leave the item unavailable to the run. Each allowed host also covers its subdomains; Browser Use doesn't honor 1Password's exact-domain autofill setting.

Create a Service Account

In 1Password, open "Developer" > "Directory" and select "Service Account" under "Access Tokens". The service account creation guide also links to the creation wizard.

Configure it as follows:

1. Enter Browser Use Demo as the service account name so you can recognize this connection in 1Password later, then click "Next".
2. Leave vault creation disabled. The connection only needs to read credentials from the vault you already created.
3. Select the Browser Use Demo vault containing your test login. Keep all other vaults unselected to limit the account's access.
4. Click the permissions icon beside the vault. Keep "Read Items" checked and leave "Write Items" and "Share Items" unchecked.
5. Click "Next" and leave environments unselected. Review the selected vault and its read-only permissions, then click "Create Account".

Save the token when it appears; the wizard displays it only once. Store it in a vault outside the one you're giving the agent access to. Don't put it in the article's example files or the agent's task prompt.

The service account's vault access and permissions cannot be edited afterward. Changing that scope requires a new service account.

Connect to Browser Use

Open the 1Password settings in Browser Use and check that the correct project is selected. Under "Service account", select "Connect 1Password". Paste the token into the "1Password Service Account Token" field and connect it.

Once connected, the integration should show "Active". Expand the integration card if needed, then select Browser Use Demo under "Vault Management" and confirm that The Internet appears.

Keep these three values distinct:

The integration requires exactly one active 1Password connection per project and is unavailable for zero-data-retention projects.

The dashboard handles the API request for you. You'll only need the last two values directly if you use the API example below.

Run the Login

Return to the Browser Use task composer. In "Run settings", open "Workspace", choose "New workspace" and leave "Browser profile" set to "No Profile" for a clean test. Open "Credentials", select "Use a whole vault", and choose Browser Use Demo. The 1Password integration guide also documents selecting individual credential fields.

Paste this prompt into the task composer, then click "Run task":

Open https://the-internet.herokuapp.com/login.
Sign in using the credentials from the connected The Internet
vault item. Use the credential-typing tools rather than copying
the example credentials printed on the page.
If the vault credentials are unavailable, stop and report that.
Verify the URL ends in /secure, the heading is Secure Area,
and a Logout link is visible. Report these checks and stop.
Do not include credential values in your response.

Watch the run and check the resulting page. Clicking "Login" is only an attempted action; the authenticated page is the useful result. For this demo, look for the success message, "Secure Area" heading, and "Logout" link.

In our dashboard test, the agent typed the_internet_username and the_internet_password through the credential tools. Both returned code: typed and ok: true for the expected origin. It then reached /secure and verified the "Secure Area" heading and the visible "Logout" link.

Because the demo prints its credentials on the page, login success alone wouldn't prove vault use. Check the credential-typing actions in your run, too. The service account's usage details can provide additional evidence of access.

Use the API

For an application or scheduled job, use the V4 REST endpoint. Download login.json and replace YOUR_VAULT_ID with the demo vault's ID. You can obtain the ID from the generated REST snippet on the "Agents" page, in its "1Password" section.

The file retains the full prompt above: use the credential-typing tools, stop if vault credentials are unavailable, avoid copying the credentials printed on the page, and verify all three page checks without reporting credential values.

Supply BROWSER_USE_API_KEY through your environment, using a key from the project where you connected 1Password. From the directory containing login.json, submit the file:

curl --fail-with-body \
  https://api.browser-use.com/api/v4/runs \
  -H "X-Browser-Use-API-Key: $BROWSER_USE_API_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @login.json

The response includes a run ID. A queued response means the task was accepted; it doesn't mean login succeeded. Set RUN_ID to that ID and inspect the run status and result:

curl --fail-with-body \
  "https://api.browser-use.com/api/v4/runs/$RUN_ID" \
  -H "X-Browser-Use-API-Key: $BROWSER_USE_API_KEY"

Check again until the status is completed, failed, or cancelled. Read the result and any error, and compare them with the page checks above. A completed run still needs to pass those login checks. Keep the example on V4; older V2 task snippets use a different request shape.

Troubleshooting

Work from the connection outward: service-account access, vault contents, destination, then the browser action.

Credential domain rules limit where a secret can be typed; they aren't a browser-wide navigation restriction. Avoid broadening them just to make an error disappear. Confirm which site should receive the credential first.

Production Tips

Use a dedicated account for the target application and give it only the permissions needed for the task. Keep unrelated logins out of the automation vault. The whole-vault option makes every supported credential field in that vault available to the run.

For a site using authenticator codes, Browser Use can use a TOTP field stored on the login item. Other verification methods may need a different workflow. Start by proving the basic login before adding those steps.

When rotating the service-account token, update the Browser Use connection before the old token expires. Revoke access when the integration is no longer needed.

Your first real task can stay small: sign in, open a read-only page, and report one visible value. Once both credential use and the result are verified, extend that task to the work you actually want to automate.

Conclusion

You now have a setup path for connecting 1Password to Browser Use and checking an authenticated task. Keep the vault limited to the logins your automation needs, verify that the agent actually uses those credentials, and build on a small working task before expanding its scope.

Sources and further reading:

• Browser Use: 1Password & 2FA covers the integration, TOTP codes, and credential settings.
• 1Password: Get Started With Service Accounts explains account creation, vault access, and token handling.
• 1Password: Use One-Time Passwords shows how to add authenticator codes to Login items.
• 1Password: Manage Service Accounts covers usage reports, token rotation, and revoking access.

Published November 9, 2026

Keep reading

Roundups

/Nov 6, 2026

Best Proxy Providers for AI Agents (2026)

Compare seven residential proxy providers for browser automation and AI agents, with hands-on task tests, entry prices, and sticky-session trade-offs.

Nik Tomazic

Explainers

/Nov 5, 2026

Computer Use vs Browser Use: How AI Agents Should Control Software

Computer use agents read screenshots and click pixels on a whole desktop. Browser use agents drive a real browser through the page and CDP. How they differ, and when to pick which.

Gregor Zunic

Comparisons

/Nov 3, 2026

Browser Use vs Kernel: Pricing, Stealth & Performance

Compare Browser Use and Kernel on pricing, proxies, stealth, performance, and session management to choose browser infrastructure for your automation.

Nik Tomazic