Key concepts

Passport lets your team call approved APIs without ever holding real secrets. Passport Cloud manages access control, while the Passport Proxy resolves secrets inside your cloud at request time. Every call is audited, and access can be revoked at any time.

Passport Cloud

Passport Cloud is the hosted backend that manages namespaces, access requests, roles, and audit history. It coordinates access control but never handles real secrets. Secret resolution happens inside your cloud through the Passport Proxy.

Passport roles

Passport uses two roles to control who can access APIs in a namespace:

• Passport Admin — Approves or denies API usage requests and maps secret references. See Manage your Passport team.
• Passport Member — Requests access to APIs they want to use. See Request access to call an API.

Namespace

A namespace is a group of related APIs. Access to APIs within a namespace is controlled through API usage requests. See Create a namespace.

Resource

A resource is an API endpoint that Passport manages access to. Resources are organized into resource groups within a namespace. Passport Members can discover and request access to resources, and the Passport Proxy brokers each authenticated request at call time. See Add resources to a namespace.

Passport Proxy

The Passport Proxy is a container-based deployment that runs inside your cloud. The proxy cryptographically validates the caller’s identity, relevant certificates, and API permissions. The proxy then resolves the secret reference from your secret store and injects the real secret into the request before forwarding it to the target API. See Lifecycle of a request.

Secret store

A secret store is an external system where your team’s API credentials and other sensitive values are stored. The Passport Proxy connects to your secret store to resolve secrets in your cloud at request time. Passport Cloud never has direct access to it. See Add resources to a namespace.

Secret reference

A secret reference is a token that points to a secret in your secret store rather than containing the secret itself. When Passport grants a consumer access to an API, it issues a secret reference, not the secret.

Secret references are cryptographically bound to the consumer they were issued to. If a reference is intercepted or stolen, anyone else who tries to use it will find the secret reference won’t work. See Map secrets.