# AX Check: 1password.com Checked 2026-11-05. Quickstart is solid, but 1Password's pricing page hides all prices Developer quickstart is clear and actionable with install steps and code examples, but pricing tiers only show "Request a quote," no stated prices or units. ## Onboarding needs a login ## Coding sessions All three independent sessions completed the pricing task. Despite the pricing page gating tiers behind "request a quote," each session found per-plan USD prices and billing assumptions (annual vs monthly, promo pricing, user minimums, trial length) from other pages or prior knowledge. ### DeepSeek V4.1 Flash [View public run](https://agents.withgauge.com/p/runs/51559570-1032-459c-883b-33895abaafd4) · [Read transcript](https://www.ax-check.com/1password.com/sessions/deepseek.json) Gave per-plan prices from fetched pricing pages and named the assumptions: USD, billed yearly, promo vs. regular price, user minimums and caps, 14-day trial, and rate-limit tiers by plan. (seq 60, seq 74, seq 130, seq 183, onepassword-example/README.md) #### End-to-end onboarding - **Onboarding needs a login**: The agent never obtained a real 1Password account or service-account token. It wrote and tested a Python SDK example, but only verified that pip install succeeded and that the SDK correctly rejects a locally-fabricated fake token with an auth error from 1Password's hosted endpoint. No real credential was created or used, and no authenticated product operation (listing real vaults, resolving a real secret) ever succeeded. The agent explicitly states the session is blocked on this missing credential. Event 171: ```text echo "=== no token ===" && python example.py; echo "exit=$?" ``` Event 172: ```text OP_SERVICE_ACCOUNT_TOKEN=ops_fake_token_for_wiring_test timeout 40 python example.py 2>&1 | head -20; echo "exit=${PIPESTATUS[0]}" ``` Event 183: ```text I cannot run the end-to-end example because I have no 1Password account or service-account token. That's the only blocker — the code is written, installs, and is proven to reach the hosted API. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No real 1Password account or service-account token available**: The session has no way to self-service a 1Password account/service-account token, so the agent could not complete an authenticated call (e.g., list real vaults or resolve a real secret). This is a credentials/test-environment limitation, not a product defect — 1Password's service-account creation explicitly requires signing in to an account via the web UI or CLI, which needs human/organizational setup. The agent correctly identified this as a normal login requirement rather than product friction. Event 183: ```text I cannot run the end-to-end example because I have no 1Password account or service-account token. That's the only blocker — the code is written, installs, and is proven to reach the hosted API. ``` Event 41: ```text 1. [Sign in](https://start.1password.com/signin) to your account on 1Password.com. 2. Open the [service account creation wizard] ``` #### Suggested Changes - **Add a direct Python SDK quickstart link from the main SDKs doc index**: The agent hit a 404 on the guessed path https://developer.1password.com/docs/sdks/python/ and had to fall back to llms.txt and the GitHub README to find real Python setup steps. Adding a working '/docs/sdks/python' (or equivalent) landing page, or linking the Python SDK quickstart directly from the SDKs overview page, would save this detour. Verify by confirming the link resolves to language-specific setup content instead of a generic overview. Event 16: ```text 404 https://developer.1password.com/docs/sdks/python/ -> 1fac647a.html (208021 bytes) ``` Event 36: ```text 404 https://www.1password.dev/sdks/overview.md -> md_overview.md (647b) ``` - **Surface service-account rate limits by plan tier directly on the pricing page**: The agent had to cross-reference the separate rate-limits doc page to learn that Individual/Family/Teams accounts get only 1,000 reads/hour and 100 writes/hour versus Business's 10,000/1,000, which materially affects which plan a developer should buy for an SDK integration. Adding a short rate-limit callout or link to this table on https://1password.com/pricing/password-manager would let developers evaluate plans without separately digging through developer docs. Verify by checking the pricing page includes or links the hourly/daily service-account limits per tier shown in the rate-limits doc. Event 130: ```text | 1Password, [1Password Families](https://support.1password.com/explore/families/), and [1Password Teams](https://support.1password.com/explore/team-admin/) | Read | 1,000 | 1 hour | Per service account token | ``` Event 122: ```text Are there rate limits for Service Accounts? Yes, 1Password Service Accounts have hourly and daily rate limits that vary by tier (Individual or Family, Teams, and Business). You can find more information on the 1Password Developer Portal . ``` ### Kimi K3 [View public run](https://agents.withgauge.com/p/runs/60f4af91-36c2-4917-9272-f22c8dd8aa43) · [Read transcript](https://www.ax-check.com/1password.com/sessions/kimi.json) Gave per-plan prices (~$8/user/mo Business, ~$20/mo flat for up to 10 on Teams) and said SDK and service-account use starts at Business. Marked as approximate. Figures came from memory and weren't checked. (seq 55, seq 54) #### End-to-end onboarding - **Onboarding needs a login**: Agent never obtained a real 1Password service account token on its own. It required a human to create a service account in the 1Password app (Settings → Developer → Service Accounts) and hand over OP_SERVICE_ACCOUNT_TOKEN. It only tested the SDK's error handling with an invalid placeholder token, which correctly failed with a format error -- no authenticated operation against the hosted product ever occurred. Event 50: ```text BLOCKED: OP_SERVICE_ACCOUNT_TOKEN is not set. Create a service account in the 1Password app and export the token. ``` Event 53: ```text Exception: invalid user input: encountered the following errors: service account token had invalid format ``` Event 55: ```text A service account token must be minted inside a 1Password account (Settings → Developer → Service Accounts), and I can't create accounts or handle billing. If you create a Business-plan service account and hand me the token, this script should work immediately. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **Service account token requires manual creation in 1Password account**: The 1Password SDK requires an OP_SERVICE_ACCOUNT_TOKEN minted via the 1Password web app (Business plan, Settings → Developer → Service Accounts). This is normal product behavior -- a credentialing step gated behind an account and plan tier -- not a product defect. The agent could not self-provision this credential and had no path to obtain one without a human. Event 50: ```text BLOCKED: OP_SERVICE_ACCOUNT_TOKEN is not set. Create a service account in the 1Password app and export the token. ``` Event 55: ```text A service account token must be minted inside a 1Password account (Settings → Developer → Service Accounts), and I can't create accounts or handle billing. ``` - **Wrong PyPI package name initially installed (agent error, self-corrected)**: Agent first installed the unofficial PyPI package named 'onepassword' (a legacy CLI wrapper) instead of the official 'onepassword-sdk', causing an ImportError. This was agent research error rather than a product issue, and it was resolved quickly within the same turn by checking PyPI metadata and the npm package. Event 21: ```text ImportError: cannot import name 'Client' from 'onepassword' (/opt/freestyle/python/lib/python3.12/site-packages/onepassword.py) ``` Event 39: ```text onepassword-sdk 0.4.2 https://github.com/1Password/onepassword-sdk-python ``` #### Suggested Changes - **Rename or deprecate the unofficial 'onepassword' PyPI package to avoid confusion with 'onepassword-sdk'**: PyPI has an old unofficial 'onepassword' package (CLI wrapper, last version 0.4.1) with a completely different API from the official 'onepassword-sdk' package. A developer following intuitive naming conventions will `pip install onepassword` and hit an ImportError. Either claim/redirect the 'onepassword' package name on PyPI to point to the official SDK, or add a prominent note in the quickstart/docs warning about this naming collision. Verify by searching 'onepassword' on PyPI and confirming the top result is unambiguous. Event 21: ```text ImportError: cannot import name 'Client' from 'onepassword' (/opt/freestyle/python/lib/python3.12/site-packages/onepassword.py) ``` Event 39: ```text onepassword-sdk 0.4.2 https://github.com/1Password/onepassword-sdk-python ``` ### Qwen 3.8 Max [View public run](https://agents.withgauge.com/p/runs/f9126e2a-90f7-4af1-a1e8-253a4c92d0e1) · [Read transcript](https://www.ax-check.com/1password.com/sessions/qwen.json) Quoted per-plan USD prices taken from the live pricing pages, with stated basis: annual vs monthly billing, promo pricing, 10-user minimum, 14-day trial, plus plan-tied rate limits and a ~$108/yr Business-seat floor. (seq 104, seq 112, seq 215, 1password-example/README.md) #### End-to-end onboarding - **Onboarding needs a login**: No real 1Password credentials were obtained. The agent built a working CLI example against the hosted SDK and verified offline functions, then tested the auth-failure path with a self-fabricated bogus JWT-shaped token (not an issued credential). Live calls returned a 'base64 decoding failed' rejection — no authenticated operation (resolving a real secret or creating an item) was ever demonstrated. The agent states plainly that no OP_SERVICE_ACCOUNT_TOKEN exists in the sandbox and minting one requires a human signed into a paid account. Event 170: ```text OP_SERVICE_ACCOUNT_TOKEN="$FAKE" timeout 90 node bin/opdemo.mjs resolve "op://Development/demo-login/password" ``` Event 171: ```text invalid service account token, please make sure you provide a valid service account token as parameter: service account token base64 decoding failed, please create another token ``` Event 159: ```text FAIL OP_SERVICE_ACCOUNT_TOKEN is not set. ``` Event 215: ```text minting one requires a human signed in to a paid 1Password account with service-account admin rights ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No service account token available to exercise live SDK calls**: Minting an OP_SERVICE_ACCOUNT_TOKEN requires a human to sign into a paid 1Password account via the web UI (or already hold a privileged token). This is a normal authentication requirement, not a product defect — the agent correctly identified it, built and tested everything that doesn't require credentials, and stopped rather than faking success. Event 159: ```text Blocked on credentials: a service account token must be minted in the 1Password web UI (or with `op service-account create`) by someone with admin rights on a paid account. ``` Event 215: ```text Live `resolve` / `write-item` cannot be run from this sandbox: there is no OP_SERVICE_ACCOUNT_TOKEN in the environment, and minting one requires signing in to a paid 1Password account in the web UI (or an already-privileged token). I can't do that step for you. ``` - **Published SDK example for generatePassword fails with opaque error**: Agent error / docs mismatch: the agent tried the flat characterSets recipe shape several times and hit a cryptic WASM error before discovering the correct tagged-union shape by reading the TypeScript type definitions directly rather than docs. Event 86: ```text {"recipe":{"length":24,"characterSets":["Digits","Letters"]}} => ERR data did not match any variant of untagged enum Invocation at line 1 c ``` Event 94: ```text gen ok, length: 24 ``` #### Suggested Changes - **Add a working JS code sample for Secrets.generatePassword to the SDK docs**: The README's JS quickstart section does not show generatePassword usage at all, and the agent found via trial-and-error (and reading dist/types.d.ts) that the correct shape is the tagged union {type:"Random", parameters:{length, includeDigits, includeSymbols}} — plausible flat shapes like {length, characterSets:[...]} throw an opaque 'data did not match any variant of untagged enum Invocation' error. Add a generatePassword example next to the resolve() example in the @1password/sdk README and verify by running it against the published package. Event 90: ```text ERR data did not match any variant of untagged enum Invocation at line 1 column 173 ``` Event 94: ```text gen ok, length: 24 ``` - **Align JS and Python SDK client-construction APIs or document the divergence**: JS 0.5.0 uses createClient({auth, integrationName, integrationVersion}) while Python 0.4.2 uses Client.authenticate(auth=..., integration_name=...) — different method names and casing conventions for the same concept. Document this explicitly on the SDK languages overview page so developers switching between languages don't assume parity; verify by cross-checking both READMEs list matching method names. Event 28: ```text "description": "The 1Password JavaScript SDK offers programmatic read access to your secrets in 1Password in an interface native to JavaScript. The SDK currently supports `Node.JS`" ``` Event 205: ```text client = await Client.authenticate(auth=token, integration_name="My 1Password Integration", integration_version="v1.0.0") ``` ### Task given to each agent Help me build a simple example using 1Password. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop. No product credentials were supplied and no purchases were authorized. ## Score: C · 50/100 (provisional) Grades come from completed site checks. Coding sessions and skipped checks do not affect the score. ### Clarity - **Failed** — Homepage answers Markdown requests ```text Homepage returned text/html for a Markdown Accept header; no Markdown representation offered. ``` - **Failed** — llms.txt provides an actionable documentation index ```text https://1password.com/llms.txt returns HTTP 404, so no documentation index exists. ``` - **Skipped** — llms.txt provides navigation guidance ```text No llms.txt body exists (404), so navigation guidance cannot be assessed. ``` - **Skipped** — llms.txt mentions offered API, MCP, and skills ```text No llms.txt body exists (404), so API/MCP/skills mentions cannot be assessed. ``` - **Pass** — A compact guide representation exists ```text Developer quickstart served as text/markdown at .md URL, a standalone Markdown representation. ``` - **Pass** — A focused guide is directly retrievable ```text Developer quickstart retrievable directly as Markdown with concrete install and auth steps. ``` - **Pass** — Equivalent instructions fit a token budget ```text Markdown quickstart is 3166 tokens, well under the 8000-token budget. ``` - **Skipped** — Product-docs links survive format changes ```text Homepage Markdown unsupported, so link preservation across formats cannot be measured. ``` - **Pass** — The compact guide is independently actionable ```text Developer quickstart gives concrete steps: install app, install CLI via brew/winget, create Environment, run op commands. ``` - **Pass** — Install and next-step links resolve ```text Quickstart install and next-step links resolve; fetched CLI, SDK, deployment and SSH pages returned 200. ``` ### Onboarding - **Pass** — Docs lead to a relevant quickstart ```text Developer quickstart gives concrete steps: install app, install CLI, create Environment, first workflow. ``` - **Pass** — Installation commands are extractable ```text Install commands extractable: brew install 1password-cli, winget install 1password-cli, apt/dnf/apk blocks. ``` - **Pass** — Code examples are available without interaction ```text Code examples shown inline without interaction: op vault list, op run --environment, ssh -T git@github.com. ``` - **Pass** — Prerequisites and auth boundaries are explicit ```text Prerequisites and auth explicit: 1Password subscription, app integration, service accounts for automation. ``` ### Pricing - **Failed** — Pricing is readable without interaction ```text Pricing page shows only 'Request a quote' for all tiers; no readable prices without contacting sales. ``` - **Failed** — Prices are stated, not gated ```text All pricing tiers are gated behind 'Request a quote' and contact-sales forms; no stated prices. ``` - **Failed** — Pricing units and limits are explicit ```text No pricing units (per user/month) or seat limits are stated; only feature bullets and quote CTAs. ``` - **Pass** — Agents identify pricing and its assumptions ```text 3 of 3 sessions were judged on pricing; 0 fell short. DeepSeek V4.1 Flash: Gave per-plan prices from fetched pricing pages and named the assumptions: USD, billed yearly, promo vs. regular price, user minimums and caps, 14-day trial, and rate-limit tiers by plan. (seq 60, seq 74, seq 130, seq 183, onepassword-example/README.md) Kimi K3: Gave per-plan prices (~$8/user/mo Business, ~$20/mo flat for up to 10 on Teams) and said SDK and service-account use starts at Business. Marked as approximate. Figures came from memory and weren't checked. (seq 55, seq 54) Qwen 3.8 Max: Quoted per-plan USD prices taken from the live pricing pages, with stated basis: annual vs monthly billing, promo pricing, 10-user minimum, 14-day trial, plus plan-tied rate limits and a ~$108/yr Business-seat floor. (seq 104, seq 112, seq 215, 1password-example/README.md) This behavioural item does not affect the fast grade. ``` ### Activation - **Pass** — An API reference or OpenAPI spec is reachable ```text Developer docs reference Events API and CLI reference; API reference reachable via 1password.dev docs. ``` - **Skipped** — An MCP server is documented and well-formed ```text No MCP server documentation found in fetched evidence. ``` - **Pass** — A CLI install path is documented ```text CLI install documented with brew, winget, apt, yum, apk commands. ``` - **Skipped** — SDK packages resolve on their registries ```text No registry lookup results for SDK packages in fetched evidence. ``` - **Skipped** — Agent skills are published ```text No agent skills published in fetched evidence. ``` [Full report data](https://www.ax-check.com/1password.com/report.json)