{"rewrite":{"id":"r_ac1e74fc43d005ec4e6a1317","clusterId":"c_a604add8599019171a9fcd50","slug":"postman-gives-passport-general-release-for-secretless-api-access","model":"deepseek-v4-1-flash","headline":"Postman Gives Passport General Release For Secretless API Access","summary":"Postman announced the general availability of Passport by Postman on September 15, 2026. The product lets developers and AI agents call authorized APIs through reference tokens instead of holding real credentials, which stay in the customer's own VPC or vault. Permissions can be scoped to exact actions, hosts, and paths, and access can be revoked in seconds. Postman says it is used by more than 40 million developers and over 500,000 organizations.","whyItMatters":"Postman is pushing beyond developer tooling into API security, betting that credentials kept inside the customer's own environment will win out over key distribution and gateway models as AI agents multiply the number of API calls.","webCardHtml":"\u003cp\u003ePassport replaces the credential with a reference token, an encrypted pointer tied to the requesting identity. The token does not work without the proxy, and the underlying API key stays in the customer\u0026#39;s VPC or vault rather than on a developer\u0026#39;s laptop.\u003c/p\u003e\u003cp\u003eAgents are handled as identities rather than exceptions. Each one gets a temporary, task-scoped identity issued from a persistent parent, and sub-agents inherit only a subset of the parent\u0026#39;s permissions. Access grants can be narrowed to specific actions, hosts, and paths before a request reaches the vault.\u003c/p\u003e","blueskyPost":"Passport's scoping to exact hosts and paths is what lets a leaked reference token do far less damage than a leaked API key. Postman is betting the credential stays in the customer's vault, not in the agent.","twitterPost":"Passport keeps real credentials in the customer's vault. A leaked reference token is scoped to hosts and paths, so it cannot do what a leaked key could.","threadsPost":"The design choice in Passport is where the credential lives. It stays in the customer's own VPC or vault, and the AI agent calls APIs through a reference token scoped to exact actions, hosts, and paths. That scope is what limits the blast radius of a stolen token.","newsletterBlurb":"Postman released Passport by Postman on September 15, 2026. The product lets developers and AI agents call authorized APIs through reference tokens while the actual credentials stay in the customer's VPC or vault. It marks Postman's expansion into API security, aimed at organizations running fleets of AI agents.","attributionJson":"[{\"source\":\"ASCII.jp\",\"url\":\"https://ascii.jp/elem/000/004/435/4435177/?rss\",\"title\":\"Postman Launches General Availability of \\\"Passport,\\\" Enabling Secretless API Access in the AI Agent Era\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":4575,"outputTokens":575,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1789526706,"createdAt":"2026-09-16T02:41:41.000Z","publishedAt":"2026-09-16T02:43:26.000Z","updatedAt":"2026-09-16T02:43:26.000Z"},"cluster":{"id":"c_a604add8599019171a9fcd50","canonicalTitle":"Postman、AIエージェント時代にシークレットレスなAPIアクセスを実現する「Passport」の一般提供を開始","representativeArticleId":"a_ec74c970a288f644aabf5fab","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[\"Passport\"],\"studios\":[\"Postman\"],\"people\":[],\"type\":\"announcement\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-09-16T00:13:04.000Z","lastSeenAt":"2026-09-16T00:13:04.000Z","updatedAt":"2026-09-16T02:43:21.000Z"},"attribution":[{"source":"ASCII.jp","url":"https://ascii.jp/elem/000/004/435/4435177/?rss","title":"Postman、AIエージェント時代にシークレットレスなAPIアクセスを実現する「Passport」の一般提供を開始"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":["Passport"],"studios":["Postman"],"people":[],"type":"announcement","domain":"other","is_roundup":false},"keyFacts":null}