> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.lettbestilt.no/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.lettbestilt.no/_mcp/server.

# Get the password gate status

GET https://www.lettbestilt.no/api/v1/site-gate

Tells the restaurant's own website whether its preview password gate should be on, and which password applies. Call it from the website's middleware or server. Then the gate can be turned off from LettBestilt at launch, without a redeploy.

**Requires an API key.** Unlike the rest of the API, browser-origin authentication is not accepted here: the response contains a password and must never be readable from a browser. `password` is only returned when `enabled` is `true`. The response is never cached (`no-store`), so turning the gate off takes effect at once.

Unlike the other endpoints, this one also answers for restaurants that are not live yet, since they are the ones that need the gate. Rate limit: 600 requests per 60 seconds per slug and IP.

Reference: https://docs.lettbestilt.no/api-reference/website/get-site-gate

## Authentication

- `Authorization` header (bearer token, required) — Either this or a trusted browser origin. The restaurant's API key, sent as `Authorization: Bearer lbs_…`. Use it from your server only, never in browser code. Keys are issued per restaurant by LettBestilt.

## Request

### Query parameters

- `slug` (string, required) — The restaurant's slug.

## Response

### 200

The gate status.

- `gate` (SiteGate, required)

## Errors

### 400 Bad Request Error

`MISSING_SLUG`: the `slug` query parameter is missing.

- `error` (ErrorBody, required)

### 401 Unauthorized Error

`UNAUTHORIZED`: missing or invalid API key, or the call came from a browser origin instead of with an API key.

- `error` (ErrorBody, required)

### 404 Not Found Error

`RESTAURANT_NOT_FOUND`: no restaurant has this slug.

- `error` (ErrorBody, required)

### 429 Too Many Requests Error

`RATE_LIMITED`: more than 600 requests in 60 seconds for this slug and IP.

- `error` (ErrorBody, required)

## Types

### SiteGate

- `enabled` (boolean, required) — Whether the website should ask for a password.
- `password` (string, optional, nullable) — Only present when `enabled` is `true`. `null` means the gate is on but no password is set. The website should then fail closed and stay locked.

### ErrorBody

- `code` (enum, required) — A machine-readable error code.
  - Allowed values: `MISSING_SLUG`, `MISSING_TOKEN`, `INVALID_JSON`, `INVALID_SUCCESS_URL`, `INVALID_CANCEL_URL`, `VALIDATION_FAILED`, `RESTAURANT_NOT_FOUND`, `ORDER_NOT_FOUND`, `RATE_LIMITED`, `BAD_REQUEST`, `UNAUTHORIZED`, `FORBIDDEN`, `POPUP_NOT_AVAILABLE`, `PRICE_CHANGED`, `PAYMENT_INCOMPLETE`, `PAYMENT_PENDING`, `PAYMENT_PROVIDER_INVALID`, `FULFILLMENT_NOT_ALLOWED`, `IDEMPOTENCY_CONFLICT`, `DINE_IN_DISABLED`, `PARTY_TOO_LARGE`, `TOO_EARLY`, `INTERNAL_ERROR`
- `message` (string, required) — A human-readable explanation. Often in Norwegian, and for business rules usually suitable to show the customer.
- `details` (any, optional) — Extra data for some codes, for example `issues` for `VALIDATION_FAILED` or the totals for `PRICE_CHANGED`.

## Examples

**Response**

```json
{
  "gate": {
    "enabled": true,
    "password": "forhandsvisning-2026"
  }
}
```

**SDK Code**

```python Website_getSiteGate_example
import requests

url = "https://www.lettbestilt.no/api/v1/site-gate"

querystring = {"slug":"slug"}

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers, params=querystring)

print(response.json())
```

```javascript Website_getSiteGate_example
const url = 'https://www.lettbestilt.no/api/v1/site-gate?slug=slug';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Website_getSiteGate_example
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://www.lettbestilt.no/api/v1/site-gate?slug=slug"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Website_getSiteGate_example
require 'uri'
require 'net/http'

url = URI("https://www.lettbestilt.no/api/v1/site-gate?slug=slug")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body
```

```java Website_getSiteGate_example
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://www.lettbestilt.no/api/v1/site-gate?slug=slug")
  .header("Authorization", "Bearer <token>")
  .asString();
```

```php Website_getSiteGate_example
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://www.lettbestilt.no/api/v1/site-gate?slug=slug', [
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp Website_getSiteGate_example
using RestSharp;

var client = new RestClient("https://www.lettbestilt.no/api/v1/site-gate?slug=slug");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "Bearer <token>");
IRestResponse response = client.Execute(request);
```

```swift Website_getSiteGate_example
import Foundation

let headers = ["Authorization": "Bearer <token>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://www.lettbestilt.no/api/v1/site-gate?slug=slug")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```