Welcome to Passport

Passport is a secure API access system that lets your team call authenticated APIs without distributing or exposing real secrets.

In most organizations, sharing API access means sharing API keys. Once a key is handed out, you’ve lost control of it. Keys get leaked, reused, or passed along without your knowledge. Passport removes secrets from the equation entirely. Instead of receiving an API key, consumers get a token that proves they’re authorized to call a specific API. The real secret never leaves your cloud. Only the Passport Proxy, running inside your infrastructure, ever resolves it.

This problem compounds with AI agents. Agents call production APIs the same way developers do, but they run continuously, multiply quickly, and often share a machine with your developers’ other tools. Every key handed to an agent widens the blast radius if it leaks. With Passport, an agent calls an API through the same kind of secret reference a developer uses, scoped to only the endpoints it’s approved for. Every call is attributed to that agent and can be revoked at any time.

Benefits of Passport

• Secure by design — Secrets are resolved inside your cloud and never leave it. Every request is cryptographically authenticated and every call is audited.

• Granular, revocable access — Access is granted per API, not per team or environment. Passport Admins can approve or revoke access to a specific API at any time.

• No code changes required — External clients like curl, scripts, and SDKs route through a local daemon transparently. Passport works with the tools your developers and agents already use, from IDEs and coding agents to CI pipelines.

• Compliance-friendly — Secrets never pass through an external network, making Passport suitable for teams in regulated industries where third-party secret exposure is a risk.

• Bring your own secret store — Passport connects to HashiCorp Vault, AWS Secrets Manager, and Google Cloud Secret Manager.