Security model

Passport enforces security at every layer. This includes how callers prove their identity, where secrets are resolved, and who controls the certificates that back each request. The following properties apply to every request:

• Identity is cryptographically proven — Passport Cloud and the proxy each verify both the user’s identity and the machine making the request, so it can’t be forged or impersonated.

• API permissions are enforced before resolution — The proxy checks what a caller is authorized to access before it ever contacts your secret store. A caller can only resolve the specific secrets they’ve been explicitly granted.

• Secrets are resolved inside your cloud — The proxy runs inside your cloud. Secrets are resolved and used there, then discarded. They don’t pass through Passport Cloud. See Lifecycle of a request.

• Every call is audited — Every API call is logged and attributed to the caller’s identity, and available as access log reports.

Passport uses your own certificate authority as the trust root. Each certificate encodes the caller’s identity, machine’s identity, approved APIs and their secret references, and access duration. Certificates are signed by your private key. Passport Admins can revoke access at any time.