> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.usepassport.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.usepassport.ai/_mcp/server.

# Setup and identity commands

Use the [`setup`](#passport-setup) command to connect your machine to the Passport Proxy, and the [`whoami`](#passport-whoami) command to verify the identity stored in your client certificate.

## `passport setup`

Provision a client certificate for the current user. Running this command connects your machine to the Passport Proxy by generating a keypair, obtaining a signed bundle from Passport Cloud, and requesting a CA-signed certificate from the proxy. The certificate encodes your identity, machine identity, approved APIs and their secret references, and access duration. For a walkthrough, see [Set up the Passport Proxy](/passport/use/connect-to-proxy/#set-up-the-passport-proxy).

This command is safe to re-run. Each run generates a fresh keypair and certificate.

> **Info**
>
> You must run `passport login` before running `passport setup`.

### Usage

```bash showLineNumbers={false}
passport setup [options]
```

### Options

**`-e, --email <email>`**

Override the identity email. Defaults to the logged-in profile.

---

**`--user-id <id>`**

Override the user ID. Defaults to the logged-in profile.

---

**`--team-id <id>`**

Override the team ID. Defaults to the logged-in profile.

---

**`--endpoint <hostname>`**

Target hostname the certificate will be used against (for example, `api.stripe.com`).

---

**`--ttl <seconds>`** — default: 300

Certificate validity period in seconds.

---

**`--management-url <url>`**

Certificate management HTTPS origin. Defaults to `--proxy-url` or the effective proxy URL.

---

**`--proxy-url <url>`**

Data-plane proxy HTTPS origin.

---

**`--proxy-server-name <host>`**

TLS server name (SNI) for the proxy connection. Defaults to the proxy host.

---

**`--namespace-id <id>`**

Namespace UUID. Passport Cloud verifies you have view access to the namespace before issuing the bundle.

---

**`--gateway-url <url>`**

Override the Bifrost gateway URL. Advanced use only.

---

**`--passport-service-url <url>`**

Override the passport-service base URL. Advanced use only.

---

**`--no-daemon`**

Skip installing and starting the daemon and setting `HTTPS_PROXY`. Use for headless or CI environments.

---

**`--verbose`**

Show the full endpoint resolution priority chain. Also enabled by setting `PASSPORT_DEBUG=1`.

---

### Examples

Run `passport setup` after `passport login`:

```bash showLineNumbers={false}
passport setup --endpoint api.stripe.com
```

Skip passport-service discovery by specifying a manual proxy endpoint:

```bash showLineNumbers={false}
passport setup --proxy-url https://my-proxy.example.com:8443
```

To use separate management and proxy endpoints:

```bash showLineNumbers={false} wordWrap
passport setup --management-url https://mgmt.example.com \
  --proxy-url https://proxy.example.com:8443
```

### Exit codes

| Code | Description                                                             |
| ---- | ----------------------------------------------------------------------- |
| `0`  | Full success. Credentials are ready and the daemon is running.          |
| `1`  | Hard failure. Credential setup failed.                                  |
| `2`  | Partial success. Credentials are ready, but the daemon failed to start. |

## `passport whoami`

Display the identity stored in the client certificate on your machine. Use this to verify your certificate is valid and confirm which identity and API permissions it encodes. For more information, see [Check your access](/passport/use/connect-to-proxy/#check-your-access).

You can also view this information in the [terminal dashboard](/passport/reference/passport-cli/dashboard/).

### Usage

```bash showLineNumbers={false}
passport whoami
```

### Example

```bash showLineNumbers={false}
passport whoami
```