Password Managers

Read every secret you enter in Crumble, such as credentials, API keys, and tokens, from 1Password or Bitwarden instead of storing it in Crumble.

A password manager keeps your secrets where they already are, and Crumble reads them when it needs them. Crumble supports 1Password and Bitwarden Secrets Manager.

Every secret you enter in Crumble can come from one:

• A bot’s credential.
• A field of a bot’s login.
• A model provider’s API key.
• An MCP server’s bearer token.
• A plugin key, such as the Exa API key or the Discord bot token.
• A machine account’s GitHub token.
• A GitHub App’s client secret.
• The client secret of an MCP server’s OAuth app.

Crumble only reads. It never writes or changes a secret in your password manager.

Connecting a Password Manager

First, create a token that can read the secrets Crumble needs:

Then, in the web app, open Settings > Password managers, select Connect next to the password manager, paste the token, and select Connect.

Crumble signs in once to check the token, then stores it encrypted with your account’s key. To change it, open the row’s More menu and select Replace token. Values read with the old token are dropped.

Over the API, send {"token": "..."} to PUT /v1/password-managers/{id}, where {id} is 1password or bitwarden.

Pointing a Secret at It

In the secret’s editor, select the password manager above the value field instead of Crumble, then paste a reference:

Crumble reads the reference once when you save and rejects the save if it can’t read it. Nothing changes until it can.

Over the API

Every endpoint that takes a secret takes the same object: a value to store, or a reference to read.

{ "value": "sk-..." }

{
  "reference": {
    "passwordManager": "1password",
    "reference": "op://Private/Acme/credential"
  }
}

Responses never include a value. They describe each secret with configured, plus the passwordManager and reference it is read from, both null for a value stored in Crumble. A password manager’s usedBy lists the keys of the secrets that read from it, such as mcp:<server ID>.

When Crumble Reads a Secret

Crumble reads a secret only when something uses it, such as a request with a credential’s placeholder or a model call. It keeps the value in memory, never on disk, and decides on each use whether to ask the password manager again:

Changing or removing a secret’s reference drops its value too.

When a Secret Can’t Be Read

What fails depends on the kind of secret:

Disconnecting

Open the row’s More menu and select Disconnect.

If Disconnect is unavailable, some secrets still read from the password manager, and the row says how many, such as (used by 3). Switch those secrets to Crumble or another reference first.