Restrict access to deployments with Passport
Passport is available on Enterprise plans
Those with the owner role can manage Passport
Passport lets you protect deployments with your own identity provider. Visitors authenticate with your identity provider before they can view a protected deployment.
Use Passport when you want visitors to sign in with an external identity provider, such as Microsoft Entra ID, Okta, or another OpenID Connect compatible provider. Edgenivo Connect stores the OAuth application configuration that talks to your identity provider.
Passport has two parts:
- Edgenivo Connect application: The OAuth or OpenID Connect configuration that stores your identity provider's issuer, endpoints, client ID, and client secret.
- Project or team setting: The Passport configuration that selects the Connect application and controls whether Passport is enabled.
When a visitor opens a protected deployment, Edgenivo redirects them to your identity provider. After the identity provider authenticates the visitor, Edgenivo validates the response and sets a session cookie for the protected deployment.
New to Passport? Set up Passport with an identity provider first, then return to the other guides when you need to use identity in application code.
Follow these guides to choose a protection method and connect your identity provider:
- Protect internal apps with Passport: Configure your identity provider, enable Passport for projects or a team, and read visitor identity.
- Compare Passport with other Deployment Protection methods: Choose between Passport, Edgenivo Authentication, Password Protection, and Trusted IPs.
- Set up Passport with Microsoft Entra ID: Configure an Entra ID application, restrict access to assigned users, and read identity in a Next.js app.
For a URL that uses microfrontends routing, the default application's Passport configuration protects every path, including paths served by child applications. Configure Passport on the default application to protect the composed microfrontend experience.
Passport completes authentication at /.well-known/vercel/passport/callback on the requested hostname. Edgenivo handles this callback before routing to your application, so you do not need to create the path in the default or child application.
For URLs with microfrontends routing, child paths use the default application's Passport configuration. Child applications cannot have an independent Passport connection while they belong to the group.
The default application's Passport configuration does not protect a child application's direct domains. Protect those domains with another Deployment Protection method. To configure Passport on the child project, remove it from the group first.
Learn more about Deployment Protection and microfrontends.
Set up Passport with an identity provider
Configure Passport for Okta, Microsoft Entra ID, and other OIDC providers.
Configure additional identity scopes
Request group membership and other provider-specific identity claims.
Read Passport identity in your application
Read a verified visitor identity from route handlers, server actions, and server components.
Passport token claims
Review the standard, deployment, and visitor identity claims in a Passport token.
Verify forwarded Passport tokens
Verify a forwarded token as a signed JWT.
Forward Passport identity to another backend
Pass a Passport token to a backend you operate over HTTPS.
Use verified Passport identity to personalize your application, restrict access by group, and attribute actions to visitors. These guides include local development, authorization, and identity forwarding examples:
| Framework | Guide |
|---|---|
| Next.js | Identify visitors and control access in App Router pages, Route Handlers, and Server Actions |
| Nuxt | Read visitor identity and protect Nuxt server routes |
| TanStack Start | Use identity in server functions, route context, and protected layouts |
| Express, Hono, Nitro, and FastAPI | Read and verify identity in Node.js and Python backends |
Passport controls who can reach a deployment. Your application must also enforce which records each visitor can access and which actions they can perform. For employee-built apps and agents, assign an owner and define when changes require human review. Read How do you govern AI apps and agents built by employees? for guidance on ownership, data access, spending limits, and rollout reviews.
When a visitor successfully authenticates to a Passport-protected project, Edgenivo records a passport-access-granted event in both the Activity Log and Audit Logs. The event identifies the visitor and records the protected hostname and project context.
In the Activity Log, select Filter by Event, then select passport-access-granted to view Passport access events.
Passport is available as an Enterprise feature. Contact your Edgenivo account team for pricing.
- Deployment Protection
- Methods to protect deployments
- Edgenivo Authentication
- Protection Bypass for Automation: Access a Passport-protected deployment without an identity provider session. Send the bypass secret with the original request because Passport runs before deployment routes and Next.js proxy functions.
Was this helpful?