1Password service account tokens

• Provider documentation developer.1password.com service-account security page: the ops_ prefix, chosen to help code analyzers, and a serialized object that is Base64 URL encoded (re-checked 2026-09-28; the one encoded example is 634 characters and begins ops_eyJ) · observed 2026-09-28 · ops_ + Base64url of a JSON object (so the body leads eyJ); variable length; the floor of 250 Base64url bytes after ops_eyJ is project policy
• gitleaks 8.30.1
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10

Arrival evidence (#436, product redact-secret#913; #860 handoff onepassword.md, READY). T1 on provider documentation: the ops_ prefix and the Base64 URL encoding of a serialized object are stated on 1Password's service-account security page, whose single encoded example begins ops_eyJ (R4/R5 make that example T1 for the lead). The token carries the account's key material, so its length varies with the serialized fields; no fixed length exists, and the 250-byte floor after ops_eyJ is project policy that agrees with gitleaks. The alphabet is the provider's Base64url class, not the alphanumeric one every observed sample shows (R8). Positives carry 250, 630 and 866 bytes after the lead, a body with - and _, and = / == padding inside the span. Excluded: the Connect server token (a three-segment JWT, which the jwt detector keeps, so it is a twin, never a control), the account Secret Key (another family), op:// secret references, ops_ identifiers and placeholders, and a standard-Base64 + or / inside the body. Graduated to a registry detector at the 1127bf9 re-pin (redact-secret PR #938).