End-to-end flow

Setting up and using Passport involves multiple roles. The following explains how each role contributes, from registering the proxy to sending an authenticated API request.

1. Register the proxy — A Passport Admin registers the Passport Proxy in the Passport admin console.

2. Set up a namespace — A Passport Admin creates a namespace and adds Passport Admins and Members.

3. Add resources — A Passport Member requests to add resources to the namespace. An Admin approves or rejects the request.

4. Request and call an API — A Member requests access to an API. An Admin approves or denies the request. Once approved, the Member connects to the proxy from their machine and can send authenticated API requests using secret references. Members can use the Passport CLI or external clients (like curl, scripts, and SDKs) to send requests.

Lifecycle of a request

When a consumer makes an API call through Passport, the following happens:

1. The consumer sends a request with a secret reference instead of a real secret.

   • Passport CLI — The request routes to the proxy running inside your cloud.
   • External clients (curl, scripts, SDKs) — A locally running daemon intercepts the outbound request and routes it to the proxy running inside your cloud.

2. The proxy receives the request.

3. The proxy authenticates the caller’s identity using a cryptographic certificate.

4. The proxy checks the caller’s API permissions. This confirms they’re authorized to use the secret reference before contacting your secret store.

5. The proxy resolves the secret from your secret store and injects it into the request.

6. The proxy forwards the request to the destination API and returns the response.

The resolved secret never passes through Passport Cloud. It also doesn’t appear in logs or audit records.