Connect to the Passport Proxy

Before you can send authenticated API requests using Passport, use the Passport CLI to connect your machine to the Passport Proxy. The Passport CLI configures your local environment to route requests through the proxy from external clients like curl and scripts. This is a one-time setup per machine.

Complete the following sections in order.

Prerequisites

Before you begin, make sure you have the following:

• A Passport Admin must approve your access request.

Install the Passport CLI

Run the following command to install the Passport CLI:

curl -o- "https://dl-passport.pstmn.io/install/unix.sh" | sh

Sign in to Passport

Sign in to your Passport account:

passport login

For all sign in options, see Authentication commands.

Set up the Passport Proxy

Run the following command to connect your machine to the proxy:

passport setup

For all setup options, see Setup and identity commands.

This command does the following:

1. Discovers your proxy — Fetches the configuration your Admin set, including the proxy URL, management host URL, and secret store providers.
2. Generates a key pair — Creates an RSA key pair where the private key never leaves your machine.
3. Issues a certificate — Sends only the public key to the proxy certificate authority (CA), which returns a signed certificate binding your identity and API permissions to it.
4. Starts the daemon — Runs a local HTTPS proxy on localhost:8081 that lets external clients (curl, scripts, SDKs) use Passport. It intercepts outbound HTTPS, opens an mTLS tunnel to the proxy using your certificate, and forwards the request. On macOS, the daemon auto-starts on sign in using launchd. On Linux, start it manually with passport daemon start.
5. Sets environment variables — Configures your shell environment so clients that respect HTTPS_PROXY route traffic through the daemon automatically. Clients that don’t support HTTPS_PROXY require manual proxy and CA configuration. Learn about the environment variables that are set.

Environment variables

Verify the setup

After setup completes, confirm that the environment variables are set correctly and the daemon is running.

Check environment variables

Open a new terminal and run the following commands to confirm the environment variables were set correctly:

echo $HTTPS_PROXY
echo $SSL_CERT_FILE
echo $NODE_EXTRA_CA_CERTS
echo $REQUESTS_CA_BUNDLE
echo $NO_PROXY

The output looks similar to the following:

http://127.0.0.1:8081
/Users/<you>/.postman/access-proxy/ca.pem
/Users/<you>/.postman/access-proxy/ca.pem
/Users/<you>/.postman/access-proxy/ca.pem
localhost,127.0.0.1,::1,10.0.0.0/8,...,.postman.com,.getpostman.com,...

Check the daemon

Run the following command to confirm the daemon is running and reachable:

passport daemon status

For all daemon options, see Daemon commands.

The output looks similar to the following:

pid              91285
port             8081
started          2026-07-16T13:02:56.415Z
upstream         <proxy-host>:8443 (reachable)
cert notAfter    2026-07-16T14:02:56.000Z
cert expires in  3542s
last mint        2026-07-16T13:02:58.123Z
allowlist mode   allowlist
allowlist hosts  api.example.com, *.example-partner.com
requests OK      47
requests reject  0

Check your access

Run the following command to confirm your identity and view which APIs you have access to:

passport whoami

For more information, see Setup and identity commands.

The output looks similar to the following:

access-proxy identity:
  userId       <user-id>
  teamId       <team-id>
  allowedApiRefs
    GET api.example.com/payments
      - API_KEY  (<provider>)
    POST api.example.com/auth
      - DB_USER  (<provider>)
      - DB_PASS  (<provider>)
  notBefore    2026-07-16T13:02:56.000Z
  notAfter     2026-07-16T14:02:56.000Z  (valid for 3480s)

Next steps

Once the setup is complete, you can send authenticated API requests using secret references. For more information, see Call an API with Passport.