---
title: "Remove password protection from a site"
method: DELETE
path: "/sites/{id}/password"
tags: ["Sites"]
---

# Remove password protection from a site

`DELETE /sites/{id}/password`

## Request

- Base URL: `https://api.nippy.host`
- URL: `https://api.nippy.host/sites/{id}/password`
- Auth: `bearer` (a scheme the document does not define)

Clears the stored hash + salt and re-publishes the KV record. Idempotent: removing on an already-unprotected site returns 200.

## Path parameters

- `id` string, required

## Response `200`

- APISitePasswordResponse
  - `id` string, required: Site UUID
  - `passwordProtected` boolean, required: Whether the site is now password-protected. The hash itself is never returned.

## Other responses

- `401`: Not authenticated
- `403`: You do not own this site
- `404`: Site not found

---

[API](https://skmtc.dev/nippy/apis/nippy-backend-api.md) · [All operations](https://skmtc.dev/nippy/apis/nippy-backend-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nippy/apis/nippy-backend-api/revisions/7ab23f040a55?raw)