---
title: "Unlock a protected drop in the visitor's browser"
method: POST
path: "/_ship/password"
---

# Unlock a protected drop in the visitor's browser

`POST /_ship/password`

## Request

- Base URL: `https://your-drop.shipped.run`
- URL: `https://your-drop.shipped.run/_ship/password`
- Auth: none required

Called on the drop's own HTTPS origin, not ship.page. The Origin header must match that exact origin. Submit JSON {password}; never put it in a URL. Success sets a host-only session cookie valid for 12 hours. Protected pages and assets require this cookie and bypass caching. An account API key does not replace the visitor cookie.

## Headers

- `Origin` string, uri, required

## Request body

- PasswordBody
  - `password` string, required: 8-128 Unicode characters, at most 512 UTF-8 bytes. Never put passwords in URLs.

## Response `200`

Unlocked. No password is returned; keep the cookie for subsequent requests to this host.

## Other responses

- `400`: Bad request — unparseable body, bad paths, invalid ttl/name, per-request file cap, invalid zip.
- `401`: Password not accepted; the drop remains locked.
- `403`: Origin does not match the drop's exact origin.
- `404`: Not found (also returned for resources owned by someone else).
- `429`: Rate limited. Back off per the Retry-After header (60s).
- `503`: Required backend unavailable. Password creation and rotation fail closed when billing cannot be verified; retry later.

## Changes

- **2026-10-20** `99aad34506e8`: 56 warning
  - added the new `already_live` enum value to the `code` response property for the response status `400`
  - added the new `already_live` enum value to the `code` response property for the response status `404`
  - added the new `already_live` enum value to the `code` response property for the response status `429`
  - added the new `already_live` enum value to the `code` response property for the response status `503`
  - …52 more

[Operation history](https://skmtc.dev/ship/apis/ship-page/changes/_ship/password/post.md)

---

[API](https://skmtc.dev/ship/apis/ship-page.md) · [All operations](https://skmtc.dev/ship/apis/ship-page/llms.txt) · [OpenAPI document](https://skmtc.dev/ship/apis/ship-page/revisions/99aad34506e8?raw)