> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.usepassport.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.usepassport.ai/_mcp/server.

# End-to-end flow

Setting up and using Passport involves [multiple roles](/passport/get-started/basics/concepts/#passport-roles). The following explains how each role contributes, from deploying the proxy to sending an authenticated API request.

1. **Create an account** — A Passport Admin [signs up for Passport](/passport/get-started/sign-up/).

2. **Deploy the proxy** — Your infrastructure team [deploys the Passport Proxy](/passport/set-up/deploy-passport-proxy/) in your Kubernetes environment.

3. **Register the proxy** — An Admin [registers the Passport Proxy](/passport/set-up/set-up-proxy/) in the Passport app.

4. **Set up a namespace** — An Admin [creates a namespace](/passport/set-up/create-namespace/) and [adds resources](/passport/set-up/add-resources/) to it, making them visible to Passport Members.

5. **Invite team members** — An Admin [invites Admins and Members](/passport/administer/manage-your-team/#manage-team-members) to the team.

6. **Request access to an API** — A Member [requests access to an API](/passport/use/request-api-access/).

7. **Approve the request** — An Admin [approves or denies the request](/passport/set-up/manage-api-access/#api-usage-requests).

8. **Connect to the proxy** — Once approved, the Member [connects to the proxy](/passport/use/connect-to-proxy/) from their machine.

9. **Call the API** — The Member [sends authenticated API requests](/passport/use/call-an-api-with-passport/) using secret references, from the Passport CLI or an external client.

10. **Revoke access** — An Admin can [revoke a Member's access](/passport/administer/governance/) to a resource at any time.

## Lifecycle of a request

When a consumer makes an API call through Passport, the following happens:

1. The consumer sends a request with a secret reference instead of a real secret.

   * **Passport CLI** — The request routes to the proxy running inside your cloud.
   * **External clients (curl, scripts, SDKs)** — A locally running daemon intercepts the outbound request and routes it to the proxy running inside your cloud.

2. The proxy receives the request.

3. The proxy authenticates the caller's identity using a cryptographic certificate.

4. The proxy checks the caller's API permissions. This confirms they're authorized to use the secret reference before contacting your secret store.

5. The proxy resolves the secret from your secret store and injects it into the request.

6. The proxy forwards the request to the destination API and returns the response.

The resolved secret never passes through Passport Cloud. It also doesn't appear in logs or audit records.