Using 1Password (and AI agents)

Save passkeys and two-factor codes in 1Password. Let AI agents use MCP instead of the login screen, and keep that API key in 1Password too

Passkeys and two-factor codes can live in 1Password

Sorabun's passkeys and two-factor authentication follow the standards (WebAuthn for passkeys, TOTP for two-factor). You can save them in a password manager such as 1Password and use them to sign in.

Save a passkey in 1Password

1. Install the 1Password browser extension on your computer and unlock it
2. Under "Passkeys" in "Users > Profile", press "Add a passkey"
3. When 1Password appears, save the passkey in 1Password

From then on, press "Log in with a passkey" on the login screen and 1Password provides the passkey. A passkey saved in 1Password also works on your other computers and phones that have 1Password.

Get the 6-digit code from 1Password

1. Under "Two-factor authentication" in "Users > Profile", press "Set up"
2. Scan the QR code with 1Password (add the QR code, or the letters and numbers under it, to the one-time password field of this site's login item)
3. Enter the 6 digits 1Password shows and press "Verify"

From then on, 1Password can fill in the 6-digit field when you sign in. The 10 backup codes are for when 1Password is unavailable, so also keep a copy somewhere other than 1Password (on paper, for example).

Let AI agents use MCP, not the login screen

Since October 2026, 1Password for Agents lets AI agents sign in to websites without seeing the password (you approve each sign-in on your own device, and supported AIs are being added over time).

Still, we don't recommend letting an AI sign in to the WordPress dashboard.

• If the image CAPTCHA is on for the login screen, the AI stops there (1Password doesn't type the CAPTCHA)
• An AI in the dashboard can do everything that user can do (including changing settings and deleting plugins)

Sorabun has an entrance made for AI: MCP. An AI connected through MCP can only use a fixed set of tools. It can't change settings, delete articles or touch API keys, and new articles are drafts by default. To have an AI write or read articles, use MCP as described in REST API and MCP Integration.

Don't write the MCP API key into a config file

The setup in REST API and MCP Integration puts the API key (sbk_…) directly into a config file. If you share that file or push it to GitHub, the key leaks with it. If you use 1Password, you can keep the key in 1Password and hand it to the AI app only when it starts.

You need: the 1Password desktop app and the 1Password CLI (op). Turn on CLI integration in the desktop app's settings, and each use of op only needs a fingerprint or similar approval.

1. Save the API key from Settings > REST API / MCP Integration as a new item in 1Password (for example, item "Sorabun MCP" in the "Private" vault)
2. In the 1Password desktop app, choose Copy Secret Reference from the key field's menu. This copies where the key is stored, such as op://Private/Sorabun MCP/credential (not the key itself). If the menu item isn't there, check each field's reference in op item get "Sorabun MCP" --format json
3. For Claude Code, write ${SORABUN_API_KEY} instead of the key in the project's .mcp.json

{
  "mcpServers": {
    "sorabun": {
      "type": "http",
      "url": "https://your-site/wp-json/sorabun/v1/mcp",
      "headers": { "Authorization": "Bearer ${SORABUN_API_KEY}" }
    }
  }
}

Finally, when you start it, read the key from 1Password and pass it in.

SORABUN_API_KEY="$(op read 'op://Private/Sorabun MCP/credential')" claude

The key stays in memory only while that session runs and is never written to a file. Since .mcp.json has no key in it, it's safe to share with your team.

On your own server, keep the AI API keys in 1Password too (VPS / cloud)

Sorabun reads wp-config.php constants before the settings screen (for example SORABUN_GEMINI_API_KEY; see Preparing API keys). So with the 1Password CLI's op inject, you can build a wp-config.php with the real keys from a template that has none. You don't need to change any plugin settings.

Template (wp-config.tpl.php, safe to keep in Git because it has no keys):

define( 'SORABUN_GEMINI_API_KEY', '{{ op://Sorabun/Gemini/credential }}' );
define( 'SORABUN_OPENAI_API_KEY', '{{ op://Sorabun/OpenAI/credential }}' );

When deploying to the server:

op inject -i wp-config.tpl.php -o wp-config.php

• When no one is at the server, use a 1Password service account and put its token in OP_SERVICE_ACCOUNT_TOKEN to run op. Service accounts can't read personal vaults such as "Private", so create a vault for Sorabun ("Sorabun" in the example above)
• The resulting wp-config.php contains the real keys. As before, keep it where it can't be read from outside, with tight permissions
• Shared hosting usually can't run op, so keep entering keys on the settings screen as before (Sorabun stores them encrypted)