[aureliensibiril]

Why

getprobo/probo#2158 moves the 1Password connector to the Users API v1 and makes Client credentials (an OAuth application's client ID and secret) the recommended way to connect. The 1Password page only covered the SCIM bridge. It said nothing about creating the OAuth application, the scope it needs, the region, or the account ID. 1Password shows the account ID only in the web app's address, and customers easily mix it up with the client ID, which has the same shape.

What

• Intro and caution. Client credentials are recommended. Accounts with automated user provisioning keep the SCIM bridge, because 1Password does not support the Users API alongside provisioning, and hosted Google Workspace provisioning gets neither method. A caution separates the account ID from the client ID and says a client ID in the Account ID field shows as Not authorized.
• Prerequisites, Collected Fields and Troubleshooting are split per method. The Users API maps display_name, email, state, id and create_time. Role, Admin, MFA and Last login are not supported.
• Option A: Client Credentials has three parts: create the OAuth application with the View users scope (with a screenshot of the form), find the account ID and region, and connect in Probo. The account ID is read from the address after View vault items (/app#/<account ID>/) or with op account get. The region is read from the sign-in address.
• Option B: SCIM Bridge keeps the existing steps. Its Token rejected entry now also tells readers to give the regenerated token to their identity provider.
• The directory card reads "OAuth application client ID and secret (recommended), or SCIM Bridge bearer token".

How it was checked

Everything was checked against a live 1Password Business account in the EU region on 2026-10-28:

• The OAuth application form and the account ID in the web app address.
• A connection from a local build of #2158 that listed the account's users.
• Calls to the Users API with the application's credentials. The API exposes the account ID nowhere (token response, introspection, headers; /v1/accounts is 404). A wrong account ID, including the client ID, gets 403 account_uuid_mismatch, which Probo shows as Not authorized.

Console labels come from #2158's locale files and provider registration. The form there now shows a hint under Account ID pointing at the same address.

npm run check:docs and npm run build pass locally.

Merge after getprobo/probo#2158 ships, since the client-credentials path describes that release.