Abhinav Asthana

CEO and Founder, Postman (

[Abhinav Asthana @a85]

.@getpostman is now natively available in your favorite coding agent!

The new Postman CLI is designed to bring API engineering for agents:

1️⃣ Works in Git and your code repo - Just drop Postman where your agent lives and works.
2️⃣ No GUI - Work in your coding agent. Bring up the Postman UI for review and approval.
3️⃣ No sign-up - Get started right away. Sign-up when you have to save your work and want more.

Install once, work in your agent. Run npm install -g postman-cli, then postman init. This loads Postman's skills into your coding agent so it can create collections, write tests, and much more. Available as a plugin for all coding agents!

The skills cover the API lifecycle: find APIs your org already has, generate tests that catch regressions, mock an API before it exists, watch live endpoints for downtime and drift, run checks in CI on every commit, and run performance tests.

You can also extend the abilities of your agent with the Context Graph. An agent often sees only the code that is accessible to them. The Context Graph API gives it a map of your team's infrastructure, APIs, and services, and how they depend on each other.

As your agent works, you stay the reviewer. Your agent does the work from the command line. Open Postman when you want to review or approve it.

Check out more at https://t.co/lqbu96vkhK!

[Abhinav Asthana @a85]

Seeing people shit on human developers who “hand-wrote” code to build working software as security issues come to light. (Of course, the fact that code is fed to LLMs to train is conveniently forgotten).

I am assuming the same people will also hold LLMs accountable when issues appear in code that nobody is apparently reading anymore.

[Abhinav Asthana @a85]

Many people figuring out what API keys mean and how to rotate them. Better to just https://t.co/gmzquznGkA

[Abhinav Asthana @a85]

Agents needing to talk to agents = More APIs!

[Sriram Krishnan @sriramk]

need an agent watching over all of my personal agents (instinct, muse, grok bot, dot, etc).

not always trivial to know *who* did *what* when everyone is operating on the same data store and APIs - essentially email and calendars.

[Ivan Burazin @ivanburazin]

We just raised a $60M Series B at a $1B valuation to build @daytonaio into the Agent Cloud.

@FirstMarkCap led the round, with all key existing investors and angels doubling down.

We're also thrilled to welcome the founders of some generational companies aboard, including @patrickc (Stripe), @tobi (Shopify), @AravSrinivas (Perplexity), @BrendanFoody (Mercor), @oliveur (Datadog), @adamdangelo (Quora) and @ericsyuan (Zoom)

We're a 35-person team. But that's about to change; we're hiring across the board, and we'd love for you to join us.

[Abhinav Asthana @a85]

@patchwanders Yes. That’s the architectural design.

[Abhinav Asthana @a85]

Sucks to hear. Avoids this and https://t.co/gmzquznGkA

API keys need to stay inside vaults and never be in circulation.

[Just_Lingonberry_352 @JustLingonberry]

FINALLY found how my key got leaked and got the $90,000 bill from google

Opus 5.5 said codex had PUBLISHED MY ****ING .ENV TO CLOUDFALRE PAGES ‼️

Meanwhile codex couldn't find anything, refused to explain itself and flagged my chat for cybersecurity risk lol

[Abhinav Asthana @a85]

How Postman governs AI agent access to 42 production systems. Check out how we use Passport at Postman: https://t.co/hZOcWEfBz6

[Abhinav Asthana @a85]

@thejessezhang Getting around through Computer Use is likely going to get agents blocked. Non-existent apis is not due to lack of ability/technology but due to the lack of a viable business model between producers and consumers.

[Abhinav Asthana @a85]

@DanielleMorrill We built Passport to eliminate the risk of keys and passwords on .env files - https://t.co/gmzquznGkA.

[Abhinav Asthana @a85]

If you don’t control your agents, agents control your company. Reiterated at https://t.co/gGdIM7L8iL

[Satya Nadella @satyanadella]

https://t.co/MjwFy73LOF

[Abhinav Asthana @a85]

@vineerpasam Yes. And you can keep secrets out of .env files altogether. We built https://t.co/gmzquznGkA for this.

[Abhinav Asthana @a85]

Or start with Passport from @getpostman - https://t.co/gmzquznGkA

[Suraj Sharma @suraj_sharma14]

Every vibe coder's pre-launch prompt:

"Claude, before I launch, do these 20 things:

1. Hide every API key. Nothing in the frontend, nothing in git
2. Rotate any key that was ever committed
3. Turn on rate limiting so one user can't burn my bill
4. Check auth on every route not just the UI
5. Lock down database rules so users only see their own data
6. Validate every input on the server
7. Add a spending cap on my AI provider
8. Make sure errors don't leak stack traces
9. Set up error tracking so I know before users tweet
10. Back up the database and actually test a restore
11. Add a 404 and a 500 page that don't look broken
12. Make it work on a cheap Android phone
13. Fix anything that takes more than 3 seconds to load
14. Add meta tags + OG image so links look good on X
15. Add privacy policy + terms (yes, really)
16. Set up analytics so I know where people drop off
17. Test signup, payment and password reset end to end
18. Make sure emails don't land in spam
19. Add a way for users to contact me
20. Write a rollback plan in case launch day goes wrong

Make no mistakes."

Funny thing is, this is genuinely the whole checklist.

Bookmark this + send it to a friend launching this week.

[Thariq @trq212]

working at a higher level of abstraction has always required understanding the lower level ones, I don't think coding agents changes this

[Abhinav Asthana @a85]

If you are building or using agents, you are likely dealing with credential sprawl. With Passport, not only did we fix credential sprawl and eliminated risk, we also found out who is using which API across humans, machines, and agents.

Read on to find out what we encountered at Postman and how we solved:

1. Building an inventory of secret sprawl
2. Identify human and agentic access
3. Control and enforcement through agentic workflows

https://t.co/s9xTk1KMo3

[Abhinav Asthana @a85]

@wuweiweiwu @getpostman You can call "tests" whatever you want. Your terms of service, SLAs, and customer contracts will dictate accountability. Not what you call it.

[Abhinav Asthana @a85]

Tests that are not verified by humans are not tests. Eventually something will break in reality and that is the actual test. The cost of that failure is what teams need to walk back from and determine what’s worth doing or not doing.

Also, you are still liable for the stuff your agent wrote.

[Richard Wu @0xrwu]

IMO the only tests you should have in the age of coding agents are, in order of priority:

1. Full E2E tests. Nothing mocked out at all. Can even be something that runs in prod on test accounts via Playwright or equivalent.
2. Integration tests. Agents make more mistakes as things bleed between data/API boundaries where schemas can drift.
3. Golden tests. This helps ground the code with real examples of data, and can be used as regressions against edge cases.

Unit tests are bloat 99% of the time if you’re using a frontier model since they’re smart enough now to get the implementation (and subsequent iterations) right on the first shot, so they only add bloat at this point.

[Abhinav Asthana @a85]

@stym06 Yes.

[Abhinav Asthana @a85]

Code review is a very narrow definition of accountability in the first place. In any system of basic complexity, that breaks down anyway. Engineers have been doing rewrites all the time. I personally rewrote @getpostman thrice.

When I am talking about accountability, I mean in the sense of consequence for the shipped artifact - not about a sub-process in the SDLC.

[Abhinav Asthana @a85]

@wuweiweiwu Agents live in a virtual world without consequences. Humans live in the real world with consequences. Verifiability means taking accountability.

[Abhinav Asthana @a85]

@_theonly1me Agree. E2E is cheaper to maintain now and need to be paired with integration across component boundaries - APIs and UI etc.

[Abhinav Asthana @a85]

I am all for new ideas and innovation but performative efficiency on productivity is tiring and a disservice to everyone.

Real questions to ask people peddling the newest non-revenue metric on their efficiency through agents on building things:

1. How is this different?
2. How much money do you make from this?
3. Are you paying API pricing for tokens or maximizing subsidized tokens?
4. What happens when your thing breaks?