---
title: "Unlock a password-protected site"
method: POST
path: "/api/sites/{slug}/gate"
tags: ["site-controller"]
---

# Unlock a password-protected site

`POST /api/sites/{slug}/gate`

## Request

- Base URL: `https://api.pagegoat.com`
- URL: `https://api.pagegoat.com/api/sites/{slug}/gate`
- Auth: HTTP bearer

Returns a pass to send as the `X-Pagegoat-Gate` header on later requests. Wrong passwords are rate limited per site and client address.

## Path parameters

- `slug` string, required

## Request body

- UnlockRequest: Try a password-protected site's link password.
  - `password` string, required: Required.

## Response `200`

Correct — here is the pass.

## Other responses

- `401`: Wrong password.
- `404`: No such site, or it isn't password protected.
- `429`: Too many wrong tries; wait it out.

---

[API](https://skmtc.dev/pagegoat/apis/pagegoat-api.md) · [All operations](https://skmtc.dev/pagegoat/apis/pagegoat-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pagegoat/apis/pagegoat-api/revisions/3e87219680af?raw)