Manage Passport with the Passport plugin

Use the passport-public-api skill to register the APIs your project calls and manage their credentials and access through the Passport API, binding each API to a credential you never see. The real secret stays out of your code, your logs, and the conversation. Reach for it whenever a task needs an API credential, rather than putting a key in a .env file, a config file, or your source.

Prerequisites

Before you run the skill, make sure you have the following:

• A running Passport Proxy, either one you set up for evaluation or one deployed in your environment.
• The Passport CLI installed and connected to that proxy. If you set up an evaluation proxy with the passport-setup skill, this is already done. Otherwise, see Install the Passport CLI and Connect to the Passport Proxy.
• A Passport API key.

What the skill can do

What the skill can do depends on the role of your Passport API key:

• Passport Admin — Registers APIs and their credentials. The agent creates namespaces, resource groups, secret references, and endpoints, binds credentials to those endpoints, and approves or rejects access requests.
• Passport Member — Requests access to the APIs a task needs. The agent finds the registered APIs and requests access, and once a Passport Admin approves, it uses the credential.

Because an Admin key can create, change, and delete everything in your Passport configuration, give the agent a Passport Member key when you only want it to request access.

The skill never returns a secret value. A create call returns a secret reference, and your code uses that reference in place of the credential:

headers = {"Authorization": "Bearer {{vault:<secretReferenceId>}}"}

Your agent sends the request through the local proxy, which substitutes the real value. Your code, your logs, and the conversation only ever hold the reference.

For the operations the skill uses, see the Passport API reference.