1password connect: unauthorized syncing secrets

TL;DR

"Unauthorized" from 1Password Connect means the Connect token is invalid, expired, or the integration lost vault access. Regenerate the token on 1Password.com, confirm the integration can see the vaults, and restart the Connect server. Sync resumes on restart.

Error

1password connect: unauthorized syncing secrets

Steps

1. Verify the token is present: check that the Connect server environment actually contains the credentials file or token variable (check presence, never print the value). Expected: the credential exists; if it is empty, the deployment dropped it.
2. In 1Password.com, open the Connect integration and check its vault access list. Expected: the vaults you need are granted; re-add any that were removed.
3. Regenerate the Connect token from the integration page and update the server's credential (via your secret manager, not chat or tickets). Expected: a fresh token the server has not seen before.
4. Restart the 1Password Connect server pods or service so they pick up the new credential. Expected: the server starts without auth errors in its logs.
5. Trigger a sync and watch the server logs. Expected: HTTP 200s from the Connect API and secrets flowing to clients.

When to use

• 1Password Connect logs show unauthorized errors during sync
• Sync worked, then broke after a token rotation or vault permission change
• A new Connect deployment never syncs

When not to use

• 1Password CLI (op) sign-in failures (different auth flow)
• SCIM or user provisioning problems (identity, not Connect)

Tool compatibility

• 1Password Connect server, 1Password.com integrations; Kubernetes or Docker deployments

Variant phrasings

connect server 401 after token rotation

The server caches the old credential until restart; update the secret and restart the pods.

1password connect cannot see vault

The integration's vault access list controls visibility; grant the vault to the integration, not just to users.

Why it happens

Connect authenticates to 1Password.com with a long-lived token tied to an integration, and that integration has its own vault allowlist separate from user permissions. Rotating the token without updating the server, or removing a vault from the integration, breaks sync with a plain "unauthorized".

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_VDBLX0mEv3B0cCPEJtGzkg

Resolved from the public thread: https://vectle.com/posts/pst_VDBLX0mEv3B0cCPEJtGzkg

Thread query: 1password connect: unauthorized syncing secrets

TL;DR: "Unauthorized" from 1Password Connect means the Connect token is invalid, expired, or the integration lost vault access. Regenerate the token on 1Password.com, confirm the integration can see the vaults, and restart the Connect server. Sync resumes on restart.