METAGROK
GROK BOT / when-1password-wont-match-vercel-preview-urls

When 1Password will not fill Vercel preview URLs in Grok Bot

when-1password-wont-match-vercel-preview-urls

You will leave knowing why a Vercel preview URL does not match a saved 1Password login, and you will have two setups that do work. This is expected matching behavior, not a 1Password bug and not a Grok Bot bug. Checked Oct 5, 2026.

Grok Bot only fills a 1Password login on a site that matches the item's saved website. Cursor staff (Colin) said on the forum on Oct 2, 2026 that it follows the same rule 1Password does: every *.vercel.app address counts as its own separate site, even when the item is in the Shared with Grok Bot vault.

1Password's own docs say it identifies matching websites by effective top-level domain (eTLD + 1), using the Public Suffix List and custom rules (autofill behavior, page published Aug 28, 2026). Vercel documents that vercel.app is on the public suffix list for security purposes. Combined, that is why project-xyz.vercel.app does not inherit a match from another preview host. 1Password items can use "Fill anywhere on this website (default)", "Only fill on this exact host", or "Never fill on this website". Multiple website fields on one item combine.

There is no 1Password page on docs.x.ai. The Bot changelog says that on a Mac you connect 1Password from the Marketplace so the Bot can sign in with saved logins, asking you first unless you turn on Auto fill. This page does not state Windows or Linux support.

Setup A: a custom preview suffix on your domain

Vercel's Preview Deployment Suffix replaces the default vercel.app suffix with a custom domain, so previews look like *.preview.yourdomain.com. It is not available on Hobby. On Pro it is a paid add-on listed at $100 / month. On Enterprise it is included and enabled by default.

  1. On a Pro or Enterprise Vercel team, enable the add-on under Settings → Billing → Add-Ons if it is not already on.
  2. Set the suffix under team Settings → General → Preview Deployment Suffix. Vercel requires using Vercel's nameservers, or delegating certificate validation to Vercel.
  3. On the 1Password item, add https://yourdomain.com as a website and keep autofill on Fill anywhere on this website.

Do not add https://vercel.app as a website hoping it will match every preview. Because vercel.app is a public suffix, that is the wrong match, and it would also match other people's deployments.

Setup B: a masked secret on the computer

Ask the Bot to "save my staging test login as secrets". Staff said this uses a masked form, the values are stored on its computer as environment variables (the Bot never sees them), they persist across tasks, and they work for Playwright. Use a dedicated non-production user. Official docs describe a secure secret request as not a general-purpose password manager: the value is masked, excluded from the transcript, and not shown to the model (approvals, security, and privacy). Those docs do not call the saved value an environment variable. That wording is from staff on the forum.

Related

Pitfalls

  • Calling this a bug. Staff and the vendor docs describe expected matching on eTLD+1.
  • Assuming Preview Deployment Suffix is free on Pro, or available on Hobby.
  • Treating a masked secret as a 1Password item. It is a Bot secret request, not a vault entry.