---
title: "Set or update the password protecting a site"
method: PUT
path: "/sites/{id}/password"
tags: ["Sites"]
---

# Set or update the password protecting a site

`PUT /sites/{id}/password`

## Request

- Base URL: `https://api.nippy.host`
- URL: `https://api.nippy.host/sites/{id}/password`
- Auth: `bearer` (a scheme the document does not define)

Hashes the supplied password (PBKDF2-SHA256) and stores it on the site. The hash + salt are mirrored into the KV record so the Worker can verify visitor credentials. The plain-text password is never stored or echoed back.

## Path parameters

- `id` string, required

## Request body

- SetSitePasswordDto
  - `password` string, required: Plain-text password to protect the site with. Hashed server-side (PBKDF2-SHA256) before storage; never echoed back.

## Response `200`

- APISitePasswordResponse
  - `id` string, required: Site UUID
  - `passwordProtected` boolean, required: Whether the site is now password-protected. The hash itself is never returned.

## Other responses

- `400`: Invalid password
- `401`: Not authenticated
- `403`: You do not own this site
- `404`: Site not found

---

[API](https://skmtc.dev/nippy/apis/nippy-backend-api.md) · [All operations](https://skmtc.dev/nippy/apis/nippy-backend-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nippy/apis/nippy-backend-api/revisions/7ab23f040a55?raw)