Call an API with Passport

As a Passport Member, you can send authenticated API requests using secret references instead of real secrets. This page covers how to send requests from the Passport CLI and external clients like curl and scripts.

To learn more about Passport roles, see Passport roles.

Prerequisites

Before you begin, make sure you have the following:

• A Passport Admin must approve your access request.
• You must have connected to the proxy from your computer.

Send a request from the Passport CLI

You can send requests directly using the Passport CLI. The Passport CLI handles mTLS directly, so no daemon is required. Use the secret reference name wherever the API requires a secret. This is the name the Admin set when mapping the secret reference, not the environment variable name. For all request options, see Request command.

For example, if the Namespace Manager mapped the secret reference POSTMAN_API_KEY to the api_key environment variable, use {{vault:POSTMAN_API_KEY}} in your request.

passport request "https://api.example.com/data" \
  -H "x-api-key: {{vault:POSTMAN_API_KEY}}"

Send a request from an external client

External clients like curl and scripts route requests through the local daemon at localhost:8081. Before sending requests, configure the ~/.postman/access-proxy/daemon.yml file to control which traffic the daemon intercepts. Then use the secret reference name wherever the API requires a secret. This is the name the Admin set when mapping the secret reference, not the environment variable name. The daemon resolves it at request time.

Configure daemon.yml

Without this file, all traffic bypasses the proxy. Open the ~/.postman/access-proxy/daemon.yml file and set one of the following modes:

Forward all — Routes every request through the proxy.

mode: forward-all

Allowlist (non-strict) — Routes only listed hosts through the proxy. Everything else goes direct.

mode: allowlist
strict: false
hosts:
  - api.example.com
  - "*.example-partner.com"

Allowlist (strict) — Routes only listed hosts through the proxy. Everything else is blocked with a 502.

mode: allowlist
strict: true
hosts:
  - api.example.com

Glob patterns are supported. Changes are picked up automatically without restarting the daemon.

Examples

With the daemon.yml file configured, use secret references wherever the API requires a secret. Secret references work anywhere in a request: headers, URL paths, query parameters, and request bodies.

curl:

curl "https://api.example.com/data" \
  -H "Authorization: Bearer {{vault:API_KEY}}"

# Header
curl -H "x-api-key: {{vault:API_KEY}}" https://api.example.com/data
# URL path
curl https://api.example.com/v1/{{vault:ACCOUNT_ID}}/transactions
# Query parameter
curl "https://api.example.com/search?token={{vault:ACCESS_TOKEN}}"
# Request body
curl -X POST https://api.example.com/auth \
  -d '{"username": "{{vault:DB_USER}}", "password": "{{vault:DB_PASS}}"}'

Node.js / TypeScript:

const response = await fetch("https://api.example.com/data", {
  headers: { "x-api-key": "{{vault:API_KEY}}" },
});
console.log(await response.json());

If fetch isn’t picking up the proxy, run your script with node --use-env-proxy your-script.js.

Configuration notes

If your HTTP client doesn’t respect HTTPS_PROXY or SSL_CERT_FILE, configure it manually to use http://127.0.0.1:8081 as the HTTPS proxy and trust the CA at ~/.postman/access-proxy/ca.pem.

Setup sets NO_PROXY to exclude Passport’s own backend domains (localhost, .postman.com, .getpostman.com, .pstmn.io, and others) so the daemon doesn’t loop its own backend calls through itself. If the API you’re testing is on an excluded domain, the request bypasses the proxy silently. To override this for a single request, clear NO_PROXY inline:

NO_PROXY="" curl "https://api.example.com/collections" \
  -H "x-api-key: {{vault:COLLECTIONS_API_KEY}}"

To override it permanently for a specific domain, remove that domain from NO_PROXY in your shell profile.