diff --git a/vaults/1password.mdx b/vaults/1password.mdx
index 24dd87f4..98acf408 100644
--- a/vaults/1password.mdx
+++ b/vaults/1password.mdx
@@ -406,6 +406,75 @@ stored-token items advertise `1pw_update_access_token` whenever no other
 token doesn't contact 1Password and doesn't retry a pending or uncertain
 operation.
 
+#### Use an approval you already have
+
+if you created an access request yourself, for example with the 1Password sdk
+or the extension in another browser, and the user approved it, you can fill
+it in KERNEL without asking again. create the item with the same
+`access_token` and `integration_key`, plus `access_request_id`, each
+`requests` entry's `id`, and `resolved` from 1Password's status. the item is
+created `ready`, and KERNEL doesn't create another access request. the
+references only work with the connection that created them; KERNEL doesn't
+check them when you create the item, and 1Password rejects a mismatched one
+when you fill.
+
+<CodeGroup>
+
+```typescript TypeScript
+// accessRequest is from opClient.credentialBroker.accessRequests.create() in the 1Password SDK.
+const status = await opClient.credentialBroker.accessRequests.getStatus(accessRequest.id);
+
+await kernel.vaults.items.upsert("github-login", {
+  id_or_name: vault.id,
+  type: "credential",
+  spec: {
+    provider: "1password",
+    access_token: tokenResponse.access_token,
+    integration_key: integrationKey,
+    requests: {
+      version: 2,
+      entries: accessRequest.entries.map((entry) => ({
+        id: entry.id,
+        type: "login",
+        parameters: { website: entry.parameters.website },
+      })),
+    },
+    access_request_id: accessRequest.id,
+    resolved: status.resolved,
+  },
+});
+```
+
+```python Python
+# access_request and status are the JSON your backend saved from 1Password's
+# create and status responses.
+kernel.vaults.items.upsert(
+    "github-login",
+    id_or_name=vault.id,
+    type="credential",
+    spec={
+        "provider": "1password",
+        "access_token": token_response["access_token"],
+        "integration_key": integration_key,
+        "requests": {
+            "version": 2,
+            "entries": [
+                {"id": entry["id"], "type": "login", "parameters": {"website": entry["parameters"]["website"]}}
+                for entry in access_request["entries"]
+            ],
+        },
+        "access_request_id": access_request["id"],
+        "resolved": status["resolved"],
+    },
+)
+```
+
+</CodeGroup>
+
+`entryId` can be omitted only when `requests` has one entry. repeating the
+create with identical values returns the current item; a different
+`access_request_id` or `resolved` at the same key returns `409`.
+
 #### Request several logins
 
 a `requests` object can hold up to five `login` entries, so one approval can