# Let the agent sign in with 1Password Give the agent a way to type a password from 1Password into a sign-in form without ever seeing it. The agent never sees a password. When a task reaches a sign-in form, the agent asks Silan to fill a saved credential, you confirm on the Mac, and Silan types it on the phone. Silan's own Vault keeps secrets in your Mac's keychain. This guide uses 1Password instead, through its command-line tool, so the password stays in 1Password. What is proved: Vault fills on a real phone, with the masked chat line and the fill check. The 1Password and Bitwarden bridges are on the current release with tests. A fill that comes from 1Password on a phone, and the one-time code field, are not yet proved on a real device. Time: about 15 minutes. You need: - 1Password on the Mac, unlocked. - The 1Password command-line tool, `op`. Silan looks for it at `/opt/homebrew/bin/op` and `/usr/local/bin/op`. - A device set up in Silan, and a test app with a sign-in form. ## Steps 1. Install the 1Password command-line tool so it lands in one of the two paths above. Check it from Terminal: ```sh /opt/homebrew/bin/op --version ``` 2. Turn on the link between the app and the tool. In 1Password open **Settings › Developer** and tick **Integrate with 1Password CLI**. From now on `op` asks 1Password itself for access, and 1Password shows its own prompt, with Touch ID where it is on. Silan passes no token and keeps no 1Password session. 3. Check Silan found it. Silan's health has a `secrets.1password.cli` check. Its warning line tells you the fix if the tool is missing or the integration is off. 4. Tell Silan which item belongs to which site. Open **Settings › Vault**. For the site, give the name an agent will use, such as `cloudocs.example`, choose 1Password as the source, and give the item as a 1Password reference, `op://Vault/Item`. Pick the apps the fill may go into and when Silan asks you: every time, once per chat, or not for an hour. Silan stores only the reference, never the secret. 5. One-time codes are a separate opt-in. Tick the one-time code field for the site only if you want the agent to fill codes too. Silan reads them from the item's `one-time password` field through `op`, never from your messages. 6. Start a chat on the device and give a task that reaches the sign-in form, such as `Open CloudDocs and sign in, then tell me the name on the account.` 7. Watch the agent reach the form. It knows the site from `list_credential_sites`, taps the username box and calls `fill_credential` with the site and `username`, then the password box and `password`. The agent gets back `filled`, never the value. 8. Answer the ask card. Silan shows **Type "cloudocs.example" from your Vault?** with **Just this once** or **For this chat**, and **Allow** or **Don't allow**. Click **Allow**. 1Password may show its own prompt at the same moment. 9. Read the step in the chat: **Typed "cloudocs.example"** with the line **from your Vault · value hidden**. The password goes only into a password box, and the agent's screenshots mask it.
Settings, Vault: the agent sees the item name and note, never the value.
Settings, Vault: the agent sees the item name and note, never the value.
If a site has no saved credential, the agent should call `request_person_login` instead. The task pauses, you sign in on the phone yourself, and the agent carries on when you hand the device back. See [Safety](/safety/). ## Bitwarden Bitwarden works the same way through its tool, `bw`, at `/opt/homebrew/bin/bw` or `/usr/local/bin/bw`. The difference is the unlock: run `bw unlock`, give the session key it prints to Silan, and Silan passes it to `bw get` for each fill. Silan never sees your master password, and locking Bitwarden in Silan drops the key. The item is named by its Bitwarden id. ## If something goes wrong - **The fill says 1Password is not installed.** `op` is not at one of the two paths Silan checks. Move or link it there. - **1Password shows no prompt and the fill fails.** The CLI integration is off. Turn it on in **Settings › Developer** in 1Password. - **The fill is denied.** The app in front is not on the site's app list, or the device is not allowed for that site. Edit the site in **Settings › Vault**. - **Bitwarden says it is locked.** Run `bw unlock` again and give Silan the new session key. :::note[Proof] Vault fills were proved on an iPhone 11 (iOS 27) on a cable, 27 and 28 Oct 2026, by a Silan worker: fills into a sign-in form, the masked chat line and the fill check. Source: verify-silan feature map, vault, and use-case facts. A fill that comes from 1Password on a phone, and the one-time code field, are not yet proved on a real device. :::