Pass the caller's credentials through

With Pass-through, Faustine stores no credential for your API. Each agent sends its own token and the gateway forwards it, so your API sees every call as the user whose token it carries. Use it when calls have to run with each person's own permissions.

How the gateway forwards the token

The client sends two credentials on every request: its gateway credential, and the token for your API in the X-Upstream-Authorization header.

X-Upstream-Authorization: Bearer <UPSTREAM_TOKEN>

The gateway checks its own key or user, scopes and limits first. It then calls your API with the value of that header as Authorization, unchanged. For a gRPC API, the value travels as the authorization metadata entry.

A request without the header fails with This API uses pass-through auth: send the upstream token in the X-Upstream-Authorization header.

Set the strategy on the API

In the portal, go to APIs and select your API.
Select the Authentication tab, then Edit.
In Sign-in method, select Pass-through.
Select Save changes.

Add a connection

A pass-through connection holds only the endpoint.

Select the Connections tab, then New connection.
Fill in the Endpoint step and select Continue.
In Credentials, there is nothing to enter. Select Continue.
Continue through Labels to Test.
In Upstream token for this test, paste a token your API accepts, with its scheme, such as Bearer eyJ…. Faustine uses it for this test only and does not store it.
Select a read operation, then Test connection.
In Review & create, select Create connection.

Test with a token

Faustine holds no credential for a pass-through API, so it cannot test on its own. Every place that tests asks for a token and discards it after the run.

Where	Field
The Test step of the New connection wizard	Upstream token for this test
Test call on a connection's page	Upstream token for this test
A test suite in the Tests tab	Upstream Authorization

Test on a connection's row in the Connections tab is not available for a pass-through connection.

Next steps

Authentication: the strategies where Faustine holds the credential.
Generate and run API tests: run a suite with an upstream token.
Add an API to a gateway: serve the API through the connection.