> ## Documentation Index
> Fetch the complete documentation index at: https://docs.goosybear.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Who can open a site

> Make a page members-only, put a password on a published site, let one person past it, or share an unpublished preview, all through the API.

Five calls decide who gets in before or after a site is live. All of them take
the usual `site_id` and optional `workspace` (see [Which workspace](https://docs.goosybear.ai/api/pages.md#which-workspace)),
and all of them **change something real for visitors, so each answers in two
calls**:

1. Send the call without `confirmation_id`. Nothing changes. You get back
   `state: "confirmation_required"`, a `confirmation_id`, and a description of
   what would happen. Show that to the person approving.
2. After they approve, send the same arguments again with the `confirmation_id`.
   That second call needs a **member's own API key**. A service-account key can
   propose but never approve (see [Service accounts](https://docs.goosybear.ai/api/service-accounts.md)).

## Make one page members-only

`page.set_access` makes one page of a site members-only, so only signed-in
members of the workspace can open it, or makes it public again.

| Field | What it is |
| - | - |
| `path` | The page's path, for example `/team`. One page by its exact path. A pattern such as `/admin/*` is refused, because a pattern is edited in the site's own `pages.deploy.json` (see [the deploy contract](https://docs.goosybear.ai/api/deploy-contract.md)). |
| `access` | `members` or `public`. |

A live site rebuilds and publishes itself with the change. A draft site picks the
change up with its next build.

## Put a password on a published site

`page.set_password` puts one shared password in front of a site that is already
published. Anyone with the address has to type it to get in.

```bash theme={null}
curl --request POST \
  --url "https://app.goosybear.ai/api/v1/tools/page.set_password" \
  --header "Authorization: Bearer $GOOSY_API_KEY" \
  --header "Content-Type: application/json" \
  --data "{\"site_id\":\"$GOOSY_SITE_ID\",\"password\":\"<8-to-256-characters>\"}"
```

* `password` is 8 to 256 characters. Send exactly what the site owner chose.
* **Setting or changing the password ends every private link and every visitor's
  saved unlock at once.** Say so when you ask for approval.
* We store a check value derived from the password, never the password itself.

## Take the password off

`page.clear_password` takes the password off so anyone with the address can read
the site. It takes only `site_id`. It makes the site **public**, and every private
link for it stops working, so say that plainly when you ask for approval.

## Let one person past the password

`page.mint_access_link` makes a private link that lets one person in without
knowing the password. It works only on a site that **has** a password.

* `ttl_minutes` is optional. We keep it inside the allowed range; leave it out
  for the default.
* The answer carries the whole link and when it expires. **It is shown once and
  can't be looked up again**, so hand it over straight away.
* Setting or clearing the password ends the link.

## Share a version that is not live

A preview link shows a site's newest build to someone before you publish. It
changes no address and publishes nothing. You can reach it two ways:

* **The REST route** `POST /api/pages/{siteId}/preview-links` takes `ttlMinutes`.
  See [Create a preview link](https://docs.goosybear.ai/api/pages.md#create-a-preview-link).
* **The tools** `page.create_preview_link` and `page.revoke_preview_link` do the
  same through the two-call approval above. To revoke, pass the `token` (the last
  part of the link's address, or the whole address). Nothing stores the token, so
  it has to come from whoever holds the link. Revoking a link that already
  expired reports the same success.

The link is shown once and can't be looked up again.

## Where to go next

* [Pages API](https://docs.goosybear.ai/api/pages.md) for importing, building and publishing.
* [Sharing your site](https://docs.goosybear.ai/api/sharing-your-site.md) for the title, description and picture a shared link shows.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.