Postman Passport controls API access without exposing credentials
Postman launches Passport, a secretless API access product keeping real credentials inside customer environments for humans and AI agents.
Postman announced general availability of Passport by Postman, a standalone API security product that keeps real API keys and tokens inside customers' own secret stores and issues inert secret references to developers, machines, and AI agents. It enforces grants down to exact action, host, and path, provides full call attribution and second-level revocation, and mints ephemeral task-scoped identities for agent fleets where sub-agents inherit only subsets of parent permissions. The product targets credential sprawl as AI agents call APIs at roughly 1,000x the rate of humans.
- GA of Passport: secretless API access for humans and AI agents
- Real credentials stay in customer secret stores; identities get inert references
- Grants down to exact action, host, and path; revocation in seconds
- Agents get ephemeral task-scoped identities with inherited subset permissions
From the original article
2 min read at helpnetsecurity.com
Postman has announced the general availability of Passport by Postman, marking the company’s expansion into API security with a standalone product that gives organizations a secure way to consume APIs as human and non-human identities increasingly work side by side.
By Industry News · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.