ID can easily be social engineered. What is the security key?

The secret key a random 34 character key[0].

You can also set up a security key[1] as 2FA, in which case you'd need both the secret key and security key.

You need to know the user/email, password, the secret key (and security key if you've added one) to get into an account. 1Password cannot recover your account for you. On a family or company account you can set up trusted members that can recover your account for you, but if everyone loses their credentials all at once then you're locked out forever and need to start over with new vaults.

[0] https://support.1password.com/secret-key-security/

[1] https://support.1password.com/security-key/

I see, thank you.

1Password accounts have a password and a security key/token you need to login.