Postman has announced the general availability of Passport by Postman, expanding the company’s footprint into the API security sector with a secretless management solution designed to handle environments where human and non-human identities operate concurrently.
The newly launched product ensures that actual API credentials remain securely stored within customer environments. At the same time, it provides enterprise security teams with comprehensive call attribution, granular access controls, and the capability to revoke permissions instantly.
As modern software development relies heavily on continuous API calls by developers and automated AI agents, managing underlying secrets such as API keys, tokens, and credentials remains a persistent security challenge. Traditional handling methods often result in sensitive data sprawling across developer machines, environmental variables, repositories, chat platforms, integrated development environment configurations, and continuous integration logs.
Industry metrics indicate that autonomous AI agents execute API calls at rates significantly higher than human developers, drastically expanding the corporate attack surface. A single compromised key can face thousands of unauthorized uses before discovery, making secretless access mechanisms vital for modern enterprise architectures.
“AI agents get their abilities through APIs, making secure access to those APIs more critical than ever,” said Abhinav Asthana, CEO of Postman. “As developers and AI agents multiply the number of API calls being made, the number of credentials in circulation is growing just as quickly. Passport provides a secretless approach to API access, allowing any human or non-human identity to call approved APIs without ever holding the real credential.”
Passport operates by keeping sensitive keys self-hosted within a customer’s cloud infrastructure and secure storage vaults. Instead of distributing raw secrets, the platform supplies developers and automated agents with a secure cryptographic pointer, or secret reference, which remains inert without the proxy and is strictly bound to the requesting identity.
Additional platform features include precise permission granting down to exact actions, hosts, and paths, validating every request against rigid security rules prior to vault interaction. Furthermore, the system supports autonomous workflows by issuing ephemeral, task-scoped identities derived from a durable parent identity, ensuring sub-agents inherit strictly limited operational permissions.