> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.usepassport.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.usepassport.ai/_mcp/server.

# Set up an evaluation proxy with the Passport plugin

Use the `passport-setup` skill to set up and verify a Passport Proxy for evaluation, locally in Docker or on a single Amazon Web Services (AWS) instance. The skill proves the end-to-end flow so you can see how Passport works before you run it in production.

> **Info**
>
> This setup is for evaluating Passport, not for production. The proxy uses an in-memory development vault, so restarting it clears any stored secrets. To deploy a production proxy backed by a durable secret store, see [Deploy the Passport Proxy](/passport/set-up/deploy-passport-proxy/).

## Prerequisites

Before you run the skill, make sure you have the following:

* A registry credential for your Passport team. A Passport Admin generates it under the **Registry** tab in the Passport app.
* Either Docker, to run the proxy locally, or an AWS account with a configured command-line interface (CLI) profile, to run it on AWS. The skill supports only these two targets.
* The `openssl`, `curl`, `jq`, and `node` command-line tools.

## What the skill can do

To get started, enter the following prompt in your agent:

setup passport

The agent asks whether to run the proxy locally in Docker or on AWS. The target you choose determines where the proxy runs and what the agent creates:

* **Local Docker** — Runs the Passport Proxy and a HashiCorp Vault as two containers on your machine. The Vault is an in-memory development instance that holds the test secrets for your evaluation.
* **AWS** — Runs those same two containers on a single EC2 instance, with Amazon CloudFront providing a trusted HTTPS address for the proxy's management port.

> **Info**
>
> The AWS setup creates billable resources in your AWS account.

For either target, the agent also sets up the Passport CLI, registers the proxy with Passport Cloud, and creates a namespace connected to it.

By the end, the agent runs an end-to-end test. A client calls an API with only a secret reference in place of a real key, and the proxy injects the real secret. The agent then offers to register your own API so you can try the same flow against a service you use.

Throughout setup, the agent confirms every cloud change before it makes it, never takes a secret value into the conversation, and tears nothing down until you tell it to.