Postman Launches Passport to Govern API Access Without Exposing Credentials
Summary
Postman announced general availability of Passport, a standalone API security product that keeps credentials in customer environments and gives developers and AI agents governed access to approved APIs.
Key points
- Passport is available as a standalone API security product for human users, machines and AI agents.
- The product keeps real API credentials in customers’ environments; users and agents receive a secret reference that requires the proxy to use.
- Organizations can restrict access by action, host and path, with requests checked against those rules before reaching the vault.
- Postman says the product provides attribution for API calls and lets security teams revoke access quickly.
- Agents receive task-scoped identities, and sub-agents inherit only a subset of their parent’s permissions.
Article Details
- Event Type
- Product launch
- Impact
- Postman launched Passport by Postman as a generally available standalone API security product. It keeps API credentials within customer environments while providing governed, auditable access for developers and AI agents, with granular permissions and rapid revocation.