Unlock a protected drop in the visitor's browser

Called on the drop's own HTTPS origin, not ship.page. The Origin header must match that exact origin. Submit JSON {password}; never put it in a URL. Success sets a host-only session cookie valid for 12 hours. Protected pages and assets require this cookie and bypass caching. An account API key does not replace the visitor cookie.

post/_ship/password

Request

  • Base URL: https://your-drop.shipped.run
  • URL: https://your-drop.shipped.run/_ship/password
  • Auth: none required

Headers

Originstring uri required

The exact HTTPS origin of the drop, with no path.

Request body

passwordstring required

8-128 Unicode characters, at most 512 UTF-8 bytes. Never put passwords in URLs.

Response

Unlocked. No password is returned; keep the cookie for subsequent requests to this host.

Changes

Changes to this operation have not been checked yet.