# Pass the caller's credentials through

With **Pass-through**, Faustine stores no credential for your API. Each agent sends its own token and the gateway forwards it, so your API sees every call as the user whose token it carries. Use it when calls have to run with each person's own permissions.

## How the gateway forwards the token

The client sends two credentials on every request: its gateway credential, and the token for your API in the `X-Upstream-Authorization` header.

```http
X-Upstream-Authorization: Bearer <UPSTREAM_TOKEN>
```

The gateway checks its own key or user, scopes and limits first. It then calls your API with the value of that header as `Authorization`, unchanged. For a gRPC API, the value travels as the `authorization` metadata entry.

A request without the header fails with `This API uses pass-through auth: send the upstream token in the X-Upstream-Authorization header`.

## Set the strategy on the API

1. In the portal, go to [**APIs**](https://auth.faustine.ai/go?to=%2Fintegrations%2Fapis) and select your API.
2. Select the **Authentication** tab, then **Edit**.
3. In **Sign-in method**, select **Pass-through**.
4. Select **Save changes**.

## Add a connection

A pass-through connection holds only the endpoint.

1. Select the **Connections** tab, then **New connection**.
2. Fill in the **Endpoint** step and select **Continue**.
3. In **Credentials**, there is nothing to enter. Select **Continue**.
4. Continue through **Labels** to **Test**.
5. In **Upstream token for this test**, paste a token your API accepts, with its scheme, such as `Bearer eyJ…`. Faustine uses it for this test only and does not store it.
6. Select a read operation, then **Test connection**.
7. In **Review & create**, select **Create connection**.

## Test with a token

Faustine holds no credential for a pass-through API, so it cannot test on its own. Every place that tests asks for a token and discards it after the run.

| Where | Field |
| --- | --- |
| The **Test** step of the **New connection** wizard | **Upstream token for this test** |
| **Test call** on a connection's page | **Upstream token for this test** |
| A test suite in the **Tests** tab | **Upstream Authorization** |

**Test** on a connection's row in the **Connections** tab is not available for a pass-through connection.

## Next steps

- [Authentication](https://docs.faustine.ai/apis/authentication/): the strategies where Faustine holds the credential.
- [Generate and run API tests](https://docs.faustine.ai/apis/tests/): run a suite with an upstream token.
- [Add an API to a gateway](https://docs.faustine.ai/agent-gateway/add-an-api/): serve the API through the connection.