Password managers: Bitwarden and 1Password
Connect Bitwarden or 1Password, add website logins, and give tasks the logins and API keys they need through secure forms in Nebula.
When a browser task needs to sign in, Nebula shows a secure setup card in the chat. Choose Set up, then save a private login in Nebula or use your Bitwarden or 1Password vault. The card works the same on desktop and mobile.
Enter credentials in the form, never in a chat message. For website logins, the agent sees only a login's name and the website it covers; the password goes straight into that site's sign-in form.
Secure cards collect browser logins and missing tool credentials. Your existing app connections keep acting as you through each app's own API.
Add a login when a task asks
Choose where to save it: Save in Nebula, Bitwarden or 1Password. Nebula encrypts what you save and keeps it private to you. A website login saved here is used only on the exact HTTPS website shown on the card.
If the password manager you pick isn't connected yet, the card asks for its connection details first. Then enter a username and password, or choose Use existing vault login if that vault already holds one for the site. To save a new item in 1Password, pick one of its vaults; the service account needs write access to it. Bitwarden saves new items in your personal vault.
Choose Save and the task continues by itself, or Not now to dismiss the card. If a save is refused, the card stays open with the reason so you can correct it.
The same card collects API keys and other credentials a task needs. A key saved to a password manager also keeps an encrypted private copy in Nebula so your tools can use it. Your vault's own connection details - the 1Password token or the Bitwarden master password - are never handed to a task's tools.
Add a website login from settings
You don't have to wait for a task to ask. Add a login ahead of time with its Website (an https:// address), Username or email and Password, then pick where to Save in and choose Save login.
Open Settings → Account → Connections → Password managers and choose Add login.
Open Settings → Connections and, under Website logins, choose Add login.
Save in Nebula is always offered. A password manager appears as a choice only once it's connected and working.
Connect one
On desktop, open Settings → Account → Connections → Password managers and choose Connect next to Bitwarden or 1Password. The mobile app has no password-manager settings; connect one from a setup card in chat, where the same fields appear.
You can connect both, and connecting one never disturbs the other. Browser tasks can use site logins from either connected vault.
Bitwarden needs three things from you: an API key, which is two values, and your master password. The API key lets Nebula sign in to your account; the master password is what actually decrypts the vault. Bitwarden's own words: your API key is not a substitute for your master password.
Sign in to your web vault - vault.bitwarden.com, or vault.bitwarden.eu if your account is on the EU region.
Go to Settings → Security → Keys and choose View API key. You'll be asked for your master password.
Copy client_id - it starts with user. - and client_secret. Ignore scope and grant_type; Nebula doesn't need them.
Back in Nebula, pick your region (US or EU), paste both values, and add your master password. Choose Connect.
Get the region right. It decides which Bitwarden server your details are sent to, and a US account won't open against the EU server.
Bitwarden's US and EU clouds only. A self-hosted Bitwarden server isn't supported - neither region points at it, so correct credentials still won't open the vault. Use 1Password if your Bitwarden is self-hosted.
Nebula holds all three values encrypted, because a Bitwarden vault cannot be decrypted without the master password. If you'd rather not store it anywhere, use 1Password instead - see the comparison below.
1Password needs one value: a service account token.
A service account cannot read your Personal, Private or Employee vault, or your default Shared vault - that's a 1Password restriction, not a Nebula one. If your logins live in Private, a service account sees nothing at all. So the first step is making a vault it can read.
Creating a service account depends on your 1Password account permissions. If you don't see the option below, your account can't create one - 1Password's advice is to ask your administrator for access. Use Bitwarden if that isn't available to you.
In 1Password, create a vault for this - call it Nebula. Move or copy the logins you want tasks to use into it. Only these logins will be reachable, which is the point: you decide exactly what Nebula can sign in to.
Sign in to 1Password.com and go to Developer → Directory, choose Other under Infrastructure Secrets Management, then Create a Service Account. You can go straight there from the service account wizard.
Name it, and grant it access to your Nebula vault only. Read access lets tasks use the logins already there. Also grant write access if you want to save new logins or keys to it from Nebula.
Copy the token. 1Password shows it once. Paste it into Nebula and choose Connect.
Your master password is never involved, and you can revoke the token in 1Password at any time without changing anything else.
Which to choose
| Bitwarden | 1Password | |
|---|---|---|
| What you hand over | API key (two values) and your master password | One service account token |
| What Nebula stores | All three, encrypted | The token, encrypted |
| Which logins it reaches | Everything in your vault | Only the vaults you grant |
| Setup | Copy two values, enter master password | Make a vault, move logins in, create a token |
| Revoke by | Rotating the client secret, or disconnecting | Deleting the service account, or disconnecting |
| Works with | Bitwarden's US or EU cloud, not self-hosted | Accounts whose permissions allow a service account |
The honest trade: Bitwarden is quicker to set up but reaches your whole vault and needs your master password stored. 1Password takes longer to set up but is scoped to a vault you choose and never involves your master password.
After it's connected
The row shows how many logins were found and how many sites they cover. That count comes from reading your vault, and it counts only logins that have a website saved on them - the ones a task can actually reach. A login with no website, like a router password or a note, is never reachable, so it isn't counted.
That's why a vault can read 0 logins even though it's full: the logins in it have no website saved. Add the site to a login in your vault and it becomes usable.
A task only uses a login when the site it's on matches one you've saved. When a task stops at a sign-in page it has no login for, a secure setup card asks you to add one so the task can continue.
If two logins in one vault cover the same site - a personal and a work account, say - the task signs in to neither. The page gives it nothing to choose between them, and signing you into the wrong account is worse than saying so. Keep one login per site in each vault Nebula reads. If both of your vaults hold a login for the same site, the task sees both, each labelled with its password manager, and neither takes priority.
If something goes wrong
"That token is valid but has not been given access to any vault." Check that the vault permits service-account access. If the service account was created without access to the vault holding your logins, create a new service account with that vault selected, then reconnect Nebula with its new token. 1Password does not let you add vaults or change permissions on an existing service account. See 1Password's service-account guidance.
"Those details did not open the vault." For Bitwarden, check the region, then the master password, then re-copy the client secret. For 1Password, the token may have been revoked; create a new one.
The row says to reconnect. A task tried to use the vault and was turned away, usually because the master password changed or the token was revoked. Connect again with current details.
A passing outage doesn't do this. If the vault simply couldn't be reached, the row stays as it was rather than sending you to re-enter details that were never wrong.
Disconnecting
Choose Disconnect. Nebula forgets the stored details immediately, and nothing reaches that vault again until you reconnect.
Disconnecting in Nebula doesn't revoke anything on the vendor's side. To be thorough, also rotate your Bitwarden client secret or delete the 1Password service account.
Connections: apps, API keys and external agents
Connect Gmail, GitHub and your other apps so agents act as you, share API keys with your workspace, and add MCP servers or agents you run yourself.
Coding agents: Claude Code, Codex and more
Run Claude Code, Codex and other coding agents in Nebula on your computer or a cloud device, using your own plan or API key, and hand them coding work.