End-to-end flow
Setting up and using Passport involves multiple roles. The following explains how each role contributes, from deploying the proxy to sending an authenticated API request.
-
Create an account — A Passport Admin signs up for Passport.
-
Deploy the proxy — Your infrastructure team deploys the Passport Proxy in your Kubernetes environment.
-
Register the proxy — An Admin registers the Passport Proxy in the Passport app.
-
Set up a namespace — An Admin creates a namespace and adds resources to it, making them visible to Passport Members.
-
Invite team members — An Admin invites Admins and Members to the team.
-
Request access to an API — A Member requests access to an API.
-
Approve the request — An Admin approves or denies the request.
-
Connect to the proxy — Once approved, the Member connects to the proxy from their machine.
-
Call the API — The Member sends authenticated API requests using secret references, from the Passport CLI or an external client.
-
Revoke access — An Admin can revoke a Member’s access to a resource at any time.
Lifecycle of a request
When a consumer makes an API call through Passport, the following happens:
-
The consumer sends a request with a secret reference instead of a real secret.
- Passport CLI — The request routes to the proxy running inside your cloud.
- External clients (curl, scripts, SDKs) — A locally running daemon intercepts the outbound request and routes it to the proxy running inside your cloud.
-
The proxy receives the request.
-
The proxy authenticates the caller’s identity using a cryptographic certificate.
-
The proxy checks the caller’s API permissions. This confirms they’re authorized to use the secret reference before contacting your secret store.
-
The proxy resolves the secret from your secret store and injects it into the request.
-
The proxy forwards the request to the destination API and returns the response.
The resolved secret never passes through Passport Cloud. It also doesn’t appear in logs or audit records.