1Password Let AI Agents Log In Without the Password — Now the Human Approval Is the Product Nobody Priced

This is not password rotation or a shared-secret vault for agents. It is a brokerage model with a human in the authorization path. When an agent reaches a sign-in form it presents a unique digital key so 1Password can verify which agent is asking; 1Password then asks the user, on their own device, which credential is needed and why. Once approved, 1Password fills the password and any one-time code into the site’s form itself, and the agent proceeds with an authenticated session it cannot read the secret behind. Access is granted per session, limited to the specific items approved, and is not carried over to the next task.

Delegated identity only works if the law agrees on who is acting, and the law has not caught up. On August 4, 2026, the Ninth Circuit vacated an injunction that had barred Perplexity’s shopping agent from Amazon, holding that because the agent acts only when a user tells it to, it is the user — not the software — accessing Amazon’s servers. That ruling opens agent commerce and closes the exit: the human remains the principal in every current doctrine, while the software does the spending. A Harvard Journal of Law and Technology digest on the same question argues the provider behind such an agent should presumptively inherit the user’s authorization unless it converts the session into its own project — an exception that has no obvious trigger.

The gap is not academic. Payments firms are already writing the verification standard — a draft Agentic Financial Service Protocol proposes verifying an AI’s identity, whether the user approved the transaction, and tracking the flow for audit — while the Cloud Security Alliance argues the attribution gap is the binding constraint on AI regulation: the enterprise cannot produce a trail showing who authorized the agent. Federal Reserve Governor Christopher Waller told Sibos in September that the lack of trust, not the technology, is the biggest obstacle to agent commerce. Add Bain’s projection of $500 billion in US AI agent commerce spending by 2030 and the sequencing is clear: liability is being written faster than delegated identity is being priced.

Here is the part of the launch that has not been priced. In the consumer product, every delegated login costs one human tap, and an agent that runs dozens of tasks a day will generate dozens of prompts — the same approval-fatigue weakness that makes push-based multi-factor authentication a soft control. Reporting on the launch made the parallel explicit: agents that book the wrong vacation or order the wrong item leave no option to cancel, so common sense is required, not just a technical control. That moves the scarce input in identity from stored secrets to human attention, and human attention is not metered, priced or throttled anywhere in the product.

That chart frames the credential-economics shift. As passkeys take a third of successful sign-ins, the secret itself becomes less valuable and the authorization decision becomes more valuable — which is exactly why 1Password’s own narrative moved from protecting passwords to establishing trusted access across humans, machines and AI agents. The paradox is that passkeys delete the human from the login loop while agent delegation puts the human back into it, per approval. The broker that resolves both is the asset, and the approval prompt is the meter.

Two structural points follow. First, the value sits at the layer nobody has built yet at scale: the broker is the only party that can prove a human approved a specific credential for a specific site at a specific moment — and the only party positioned to write the audit record that payment regulators are starting to ask for. Second, the volume behind it is not speculative. Palo Alto Networks’ 2026 Identity Security Landscape survey of 2,930 security leaders found 109 machine identities for every human identity, up from 82 to 1 a year earlier, with 79 of those 109 being AI agents and agent identities expected to grow 85% over the next twelve months against 77% for machine identities overall. Every one of those agents is a candidate for a delegated credential.

Reconciling the ARR figures is where the economics get interesting. ARR moved from about $400 million in November 2025 to more than $500 million in October 2026, so the stock grew roughly 25% in eleven months — yet net new ARR growth ran near 60% across the first three quarters and near 90% in the third. With gross retention at 90%, that gap implies gross additions near $140 million against roughly $40 million of annual churn: the net-new headline flatters the base, and the company is monetizing churn replacement as much as new logos.