> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.usepassport.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.usepassport.ai/_mcp/server.

# Key concepts

Passport lets your team call approved APIs without ever holding real secrets. Passport Cloud manages access control, while the Passport Proxy resolves secrets inside your cloud at request time. Every call is audited, and access can be revoked at any time.

## Passport Cloud

Passport Cloud is the hosted backend that manages namespaces, access requests, roles, and audit history. It coordinates access control but never handles real secrets. Secret resolution happens inside your cloud through the Passport Proxy.

## Passport roles

Passport uses two roles to control who can access APIs in a namespace:

* **Passport Admin** — Approves or denies API usage requests and maps secret references. See [Manage your Passport team](/passport/administer/manage-your-team/).
* **Passport Member** — Requests access to APIs they want to use. See [Request access to call an API](/passport/use/request-api-access/).

## Namespace

A namespace is a group of related APIs. Access to APIs within a namespace is controlled through API usage requests. See [Create a namespace](/passport/set-up/create-namespace/).

## Resource

A resource is an API endpoint that Passport manages access to. Resources are organized into resource groups within a namespace. Passport Members can discover and [request access to resources](/passport/use/request-api-access/), and the Passport Proxy brokers each authenticated request at call time. See [Add resources to a namespace](/passport/set-up/add-resources/).

## Passport CLI

The Passport CLI is a command-line tool you install on your machine to authenticate with Passport, connect to the Passport Proxy, and send authenticated API requests. See [Connect to the Passport Proxy](/passport/use/connect-to-proxy/).

## Passport Proxy

The Passport Proxy is a container-based deployment that runs inside your cloud. The proxy cryptographically validates the caller's identity, relevant certificates, and API permissions. The proxy then resolves the secret reference from your secret store and injects the real secret into the request before forwarding it to the target API. See [Lifecycle of a request](/passport/get-started/basics/end-to-end-flow/#lifecycle-of-a-request).

## Secret store

A secret store is an external system where your team's API credentials and other sensitive values are stored. The Passport Proxy connects to your secret store to resolve secrets in your cloud at request time. Passport Cloud never has direct access to it. See [Add resources to a namespace](/passport/set-up/add-resources/).

## Secret reference

A secret reference is a token that points to a secret in your secret store rather than containing the secret itself. When Passport grants a consumer access to an API, it issues a secret reference, not the secret.

Secret references are cryptographically bound to the consumer they were issued to. If a reference is intercepted or stolen, anyone else who tries to use it will find the secret reference won't work. See [Map secrets](/passport/set-up/add-resources/#step-4-map-secrets).