The problem
Use case: replacing a 1Password-backed GitHub PAT item.
I need to point the existing Executor connection at that replacement without rebuilding its toolkit memberships or connection-specific policies. In my self-hosted setup, Accounts → connection menu → Edit exposes only Description and Account label; Reconnect does not offer a credential picker.
Proposed shape
Add “Change credential” to the connection menu, using the existing provider/item picker.
- Validate the replacement before saving; retain the original binding on failure.
- Preserve the connection identity/address, metadata, toolkit memberships, and policy rules.
- Use the replacement for subsequent calls and refresh health without exposing secret values.
This request concerns changing the credential reference, not editing the secret inside 1Password.
Alternatives
Considered creating a second connection and manually reproducing its settings, but that changes the connection address and requires reviewing connection-specific references.
Updating the original 1Password item in place would avoid rebinding, but that has it's security limitations when allowing agents to manage your 1Password vaults. I give my agent read permissions to my relevant vaults and write permissions only to one staging vault. It clones and updates the existing 1Password items, which I then move from the staging vault into the relevant vault, whilst deleting the old retired item version.
Where it belongs
Self-host (Docker)
Before you submit
The problem
Use case: replacing a 1Password-backed GitHub PAT item.
I need to point the existing Executor connection at that replacement without rebuilding its toolkit memberships or connection-specific policies. In my self-hosted setup, Accounts → connection menu → Edit exposes only Description and Account label; Reconnect does not offer a credential picker.
Proposed shape
Add “Change credential” to the connection menu, using the existing provider/item picker.
This request concerns changing the credential reference, not editing the secret inside 1Password.
Alternatives
Considered creating a second connection and manually reproducing its settings, but that changes the connection address and requires reviewing connection-specific references.
Updating the original 1Password item in place would avoid rebinding, but that has it's security limitations when allowing agents to manage your 1Password vaults. I give my agent read permissions to my relevant vaults and write permissions only to one staging vault. It clones and updates the existing 1Password items, which I then move from the staging vault into the relevant vault, whilst deleting the old retired item version.
Where it belongs
Self-host (Docker)
Before you submit