> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.usepassport.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.usepassport.ai/_mcp/server.

# Connect to the Passport Proxy

Before you can send authenticated API requests using Passport, use the Passport CLI to connect your machine to the Passport Proxy. The Passport CLI configures your local environment to route requests through the proxy from external clients like curl and scripts. This is a one-time setup per machine.

Complete the following sections in order.

## Prerequisites

Before you begin, make sure you have the following:

* A Passport Admin must approve your [access request](/passport/use/request-api-access/).

## Install the Passport CLI

Install the Passport CLI using whichever option applies:

* **Self-serve** — Install the Passport CLI on your own machine. See [Install the Passport CLI](/passport/reference/passport-cli/install/).
* **Managed deployment** — If your organization manages your machine, your IT team may deploy the Passport CLI for you with a mobile device management tool (MDM). See [Deploy the Passport CLI with mobile device management](/passport/reference/passport-cli/deploy-with-mdm/).

## Sign in to Passport

Sign in to your Passport account:

```sh showLineNumbers={false}
passport login
```

For all sign in options, see [Authentication commands](/passport/reference/passport-cli/login/).

## Set up the Passport Proxy

Run the following command to connect your machine to the proxy, using the management URL and proxy URL from your Admin:

```sh showLineNumbers={false} wordWrap
passport setup --management-url <management_url> --proxy-url <proxy_url>:8443
```

For all setup options, see [Setup and identity commands](/passport/reference/passport-cli/setup/).

This command does the following:

1. **Discovers your proxy** — Fetches the [configuration](/passport/set-up/set-up-proxy/) your Admin set, including the proxy URL, management host URL, and secret store providers.
2. **Generates a key pair** — Creates an RSA key pair where the private key never leaves your machine.
3. **Issues a certificate** — Sends only the public key to the proxy certificate authority (CA), which returns a signed certificate binding your identity and API permissions to it.
4. **Starts the daemon** — Runs a local HTTPS proxy on `localhost:10144` that lets external clients (curl, scripts, SDKs) use Passport. It intercepts outbound HTTPS, opens an mTLS tunnel to the proxy using your certificate, and forwards the request. On macOS, the daemon auto-starts on sign in using `launchd`. On Windows, the daemon also auto-starts on sign in. On Linux, start it manually with `passport daemon start`.
5. **Sets environment variables** — Configures your shell environment so clients that respect `HTTPS_PROXY` route traffic through the daemon automatically. Clients that don't support `HTTPS_PROXY` require manual proxy and CA configuration. Learn about the [environment variables](#environment-variables) that are set.

> **Info**
>
> This command is safe to re-run. Each run generates a fresh key pair and certificate.

### Environment variables

| Variable              | Value                                                                          | Purpose                                                                |
| --------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------------------- |
| `HTTPS_PROXY`         | `http://127.0.0.1:10144`                                                       | Routes HTTPS traffic through the daemon.                               |
| `SSL_CERT_FILE`       | `~/.passport/ca.pem` (macOS/Linux), `%USERPROFILE%\.passport\ca.pem` (Windows) | Trusts the proxy's CA (OpenSSL, Python).                               |
| `NODE_EXTRA_CA_CERTS` | `~/.passport/ca.pem` (macOS/Linux), `%USERPROFILE%\.passport\ca.pem` (Windows) | Trusts the proxy's CA (Node.js).                                       |
| `REQUESTS_CA_BUNDLE`  | `~/.passport/ca.pem` (macOS/Linux), `%USERPROFILE%\.passport\ca.pem` (Windows) | Trusts the proxy's CA (Python requests).                               |
| `NO_PROXY`            | `localhost,.postman.com,...`                                                   | Prevents Passport's own backend calls from looping through the daemon. |

Some tools validate certificates against your OS's own certificate trust store instead of these environment variables. Run [`passport ca install`](/passport/reference/passport-cli/ca/) so these tools trust the Passport CA too.

## Verify the setup

After setup completes, confirm that the environment variables are set correctly and the daemon is running.

> **Info**
>
> For a live view of daemon status and your certificate's grants, see [View the terminal dashboard](/passport/reference/passport-cli/dashboard/).

### Check environment variables

Open a new terminal and run the following commands to confirm the [environment variables](#environment-variables) were set correctly.

#### macOS/Linux

```sh showLineNumbers={false}
echo $HTTPS_PROXY
echo $SSL_CERT_FILE
echo $NODE_EXTRA_CA_CERTS
echo $REQUESTS_CA_BUNDLE
echo $NO_PROXY
```

The output looks similar to the following:

```sh showLineNumbers={false}
http://127.0.0.1:10144
/Users/<you>/.passport/ca.pem
/Users/<you>/.passport/ca.pem
/Users/<you>/.passport/ca.pem
localhost,127.0.0.1,::1,10.0.0.0/8,...,.postman.com,.getpostman.com,...
```

#### Windows (PowerShell)

```powershell showLineNumbers={false}
echo $env:HTTPS_PROXY
echo $env:SSL_CERT_FILE
echo $env:NODE_EXTRA_CA_CERTS
echo $env:REQUESTS_CA_BUNDLE
echo $env:NO_PROXY
```

The output looks similar to the following:

```powershell showLineNumbers={false}
http://127.0.0.1:10144
C:\Users\<you>\.passport\ca.pem
C:\Users\<you>\.passport\ca.pem
C:\Users\<you>\.passport\ca.pem
localhost,127.0.0.1,::1,10.0.0.0/8,...,.postman.com,.getpostman.com,...
```

### Check the daemon

Run the following command to confirm the daemon is running and reachable:

```sh showLineNumbers={false}
passport daemon status
```

For all daemon options, see [Daemon commands](/passport/reference/passport-cli/daemon/).

The output looks similar to the following:

```sh showLineNumbers={false}
pid              91285
port             10144
started          2026-07-16T13:02:56.415Z
upstream         <proxy-host>:8443 (reachable)
cert notAfter    2026-07-16T13:07:56.000Z
cert expires in  242s
last mint        2026-07-16T13:02:58.123Z
allowlist mode   allowlist
allowlist hosts  api.example.com, *.example-partner.com
requests OK      47
requests reject  0
```

## Check your access

Run the following command to confirm your identity and view which APIs you have access to:

```sh showLineNumbers={false}
passport whoami
```

For more information, see [Setup and identity commands](/passport/reference/passport-cli/setup/#passport-whoami).

The output looks similar to the following:

```sh showLineNumbers={false}
access-proxy identity:
  userId       <user-id>
  teamId       <team-id>
  allowedApiRefs
    GET api.example.com/payments
      - API_KEY  (<provider>)
    POST api.example.com/auth
      - DB_USER  (<provider>)
      - DB_PASS  (<provider>)
  notBefore    2026-07-16T13:02:56.000Z
  notAfter     2026-07-16T13:07:56.000Z  (valid for 180s)
```

## Next steps

Once the setup is complete, you can send authenticated API requests using secret references. For more information, see [Call an API with Passport](/passport/use/call-an-api-with-passport/).