Postman Passport Gives AI Agents Keyless API Access

The Credential Problem Agents Made Worse

Postman announced general availability of Passport on September 15, 2026, a standalone API security product built around a simple idea: stop handing out real credentials. Instead of distributing an API key, Passport issues a cryptographic reference — a token that points at a secret without containing it. The actual key never leaves your own network. Help Net Security and heise online both covered the launch.

• Model: callers receive a secret reference, not a credential; a proxy inside your network resolves it and injects the real key
• Granularity: permissions can be scoped down to specific actions, hosts and paths
• Agents: ephemeral, task-scoped identities that inherit a subset of a parent's permissions
• Response: full attribution for every call, with revocation in seconds

Why Do Static API Keys Fail So Badly?

Because they spread, and they do not expire. The moment a long-lived API key lands on a developer's laptop it starts propagating: into a .env file, into a repository, into a chat message asking someone to debug a failing request, into an IDE config, into CI logs. Each copy is indistinguishable from the original, which means a leaked key can be used thousands of times before anyone notices, and the logs cannot tell you which copy did it.

AI agents take every part of that and multiply it. An agent fleet calling APIs continuously turns a credential that used to be exercised a few hundred times a day into one exercised constantly, by software, across many concurrent tasks. Attribution gets harder at exactly the moment it matters more.

Postman's CEO Abhinav Asthana framed the product as letting any human or non-human identity call approved APIs without ever holding the real credential. The architecture is what makes that claim work rather than marketing: the secret stays in your secret store, a proxy running inside your network resolves the reference and forwards the authenticated request.

What Does Task-Scoped Agent Identity Actually Buy You?

This is the part worth reading twice. Passport can mint ephemeral identities for agents, each inheriting only a subset of the parent's permissions and each scoped to a single task.

Think about the blast radius. Under the old model, an agent that gets prompt-injected into doing something unintended is holding the same credential its operator holds, with the same scope — which usually means far more scope than the task required. Under task-scoped identity, the same compromised agent holds a reference valid for one job, on specific hosts and paths, and expiring when the job does. The attack still happens; it just cannot reach very far.

That is the same structural argument behind two things we have covered recently: the ORKS open standard for revocable API keys, which tackles the revocation half of the problem with an interoperable spec, and Zanzibar-style relationship-based authorization, which does it for object-level permissions. Different layers, same principle — the defence that scales is narrowing what a credential can do, not trying harder to keep it secret.

What This Does Not Solve

Worth being straight about the limits. A secretless architecture removes the credential from the caller, which is a large class of leak, but it does not remove the caller's ability to make approved calls. If an agent is compromised and its scoped permissions include an action an attacker wants, that action is still available to them. Scoping decisions therefore become the security control, and they are only as good as the person who wrote them.

There is also a new component in the path. A proxy that resolves references and injects credentials is, by construction, a high-value target sitting inside your network, and it needs the monitoring and patching discipline that implies.

None of which argues against the approach. It is a clear improvement over shipping long-lived keys to everything that needs to make a request, and it arrives at the right moment — agent fleets are being deployed considerably faster than the identity infrastructure meant to govern them. Postman is a vendor with an obvious commercial interest in this space, so evaluate the claims accordingly; the design pattern is sound regardless of who ships it. More on securing agentic systems in our AI security section.

Sources: Help Net Security — September 15, 2026; heise online — September 2026; Postman Blog — September 2026.