Skip to navigation
Use Passport

Connect to the Passport Proxy

Before you can send authenticated API requests using Passport, use the Passport CLI to connect your machine to the Passport Proxy. The Passport CLI configures your local environment to route requests through the proxy from external clients like curl and scripts. This is a one-time setup per machine.

Complete the following sections in order.

Prerequisites

Before you begin, make sure you have the following:

Install the Passport CLI

Install the Passport CLI using whichever option applies:

Sign in to Passport

Sign in to your Passport account:

passport login

For all sign in options, see Authentication commands.

Set up the Passport Proxy

Run the following command to connect your machine to the proxy, using the management URL and proxy URL from your Admin:

passport setup --management-url <management_url> --proxy-url <proxy_url>:8443

For all setup options, see Setup and identity commands.

This command does the following:

  1. Discovers your proxy — Fetches the configuration your Admin set, including the proxy URL, management host URL, and secret store providers.
  2. Generates a key pair — Creates an RSA key pair where the private key never leaves your machine.
  3. Issues a certificate — Sends only the public key to the proxy certificate authority (CA), which returns a signed certificate binding your identity and API permissions to it.
  4. Starts the daemon — Runs a local HTTPS proxy on localhost:10144 that lets external clients (curl, scripts, SDKs) use Passport. It intercepts outbound HTTPS, opens an mTLS tunnel to the proxy using your certificate, and forwards the request. On macOS, the daemon auto-starts on sign in using launchd. On Windows, the daemon also auto-starts on sign in. On Linux, start it manually with passport daemon start.
  5. Sets environment variables — Configures your shell environment so clients that respect HTTPS_PROXY route traffic through the daemon automatically. Clients that don’t support HTTPS_PROXY require manual proxy and CA configuration. Learn about the environment variables that are set.

This command is safe to re-run. Each run generates a fresh key pair and certificate.

Environment variables

VariableValuePurpose
HTTPS_PROXYhttp://127.0.0.1:10144Routes HTTPS traffic through the daemon.
SSL_CERT_FILE~/.passport/ca.pem (macOS/Linux), %USERPROFILE%\.passport\ca.pem (Windows)Trusts the proxy’s CA (OpenSSL, Python).
NODE_EXTRA_CA_CERTS~/.passport/ca.pem (macOS/Linux), %USERPROFILE%\.passport\ca.pem (Windows)Trusts the proxy’s CA (Node.js).
REQUESTS_CA_BUNDLE~/.passport/ca.pem (macOS/Linux), %USERPROFILE%\.passport\ca.pem (Windows)Trusts the proxy’s CA (Python requests).
NO_PROXYlocalhost,.postman.com,...Prevents Passport’s own backend calls from looping through the daemon.

Some tools validate certificates against your OS’s own certificate trust store instead of these environment variables. Run passport ca install so these tools trust the Passport CA too.

Verify the setup

After setup completes, confirm that the environment variables are set correctly and the daemon is running.

For a live view of daemon status and your certificate’s grants, see View the terminal dashboard.

Check environment variables

Open a new terminal and run the following commands to confirm the environment variables were set correctly.

echo $HTTPS_PROXY
echo $SSL_CERT_FILE
echo $NODE_EXTRA_CA_CERTS
echo $REQUESTS_CA_BUNDLE
echo $NO_PROXY

The output looks similar to the following:

http://127.0.0.1:10144
/Users/<you>/.passport/ca.pem
/Users/<you>/.passport/ca.pem
/Users/<you>/.passport/ca.pem
localhost,127.0.0.1,::1,10.0.0.0/8,...,.postman.com,.getpostman.com,...

Check the daemon

Run the following command to confirm the daemon is running and reachable:

passport daemon status

For all daemon options, see Daemon commands.

The output looks similar to the following:

pid              91285
port             10144
started          2026-07-16T13:02:56.415Z
upstream         <proxy-host>:8443 (reachable)
cert notAfter    2026-07-16T13:07:56.000Z
cert expires in  242s
last mint        2026-07-16T13:02:58.123Z
allowlist mode   allowlist
allowlist hosts  api.example.com, *.example-partner.com
requests OK      47
requests reject  0

Check your access

Run the following command to confirm your identity and view which APIs you have access to:

passport whoami

For more information, see Setup and identity commands.

The output looks similar to the following:

access-proxy identity:
  userId       <user-id>
  teamId       <team-id>
  allowedApiRefs
    GET api.example.com/payments
      - API_KEY  (<provider>)
    POST api.example.com/auth
      - DB_USER  (<provider>)
      - DB_PASS  (<provider>)
  notBefore    2026-07-16T13:02:56.000Z
  notAfter     2026-07-16T13:07:56.000Z  (valid for 180s)

Next steps

Once the setup is complete, you can send authenticated API requests using secret references. For more information, see Call an API with Passport.