diff --git a/app/assets/stylesheets/application.css b/app/assets/stylesheets/application.css
index d23263d..5b9b3b8 100644
--- a/app/assets/stylesheets/application.css
+++ b/app/assets/stylesheets/application.css
@@ -1,6 +1,6 @@
 body {
     font-family: sans-serif;
-    margin: 40px;
+    margin: 10px 40px;
 }
 
 header {
@@ -103,12 +103,15 @@ button.action:hover {
     cursor: pointer;
 }
 
-.action {
+.needs_pwd {
     display: none;
 }
 
-.action.shown {
+.needs_pwd.shown {
     display: block;
+}
+
+.action.shown {
     height: 100%;
 }
 
@@ -134,3 +137,16 @@ section .meta {
     top: 0;
     left: 0;
 }
+
+span#password {
+    font-family: monospace;
+    background-color: black;
+    color: white;
+    font-weight: bold;
+    font-size: 16px;
+    padding: 1px 4px;
+}
+
+.hidden {
+    display: none;
+}
diff --git a/app/controllers/instance_controller.rb b/app/controllers/instance_controller.rb
index 3ebd248..535829d 100644
--- a/app/controllers/instance_controller.rb
+++ b/app/controllers/instance_controller.rb
@@ -38,6 +38,16 @@ class InstanceController < ApplicationController
     end
   end
 
+  def authenticate
+    password, instance = auth_params
+    inst = Instance.find_by(public_id: instance)
+    if password == inst.password
+      @id = inst.public_id
+      @password = inst.password
+      render "set_password"
+    end
+  end
+
   private
 
   def create_instance_params
@@ -51,4 +61,8 @@ class InstanceController < ApplicationController
   def pop_instance_params
     params.expect(:instance, :nm, :pwd)
   end
+
+  def auth_params
+    params.expect(:password, :instance)
+  end
 end
diff --git a/app/javascript/list.js b/app/javascript/list.js
index 7f83b03..80ecc6d 100644
--- a/app/javascript/list.js
+++ b/app/javascript/list.js
@@ -7,11 +7,20 @@ function checkPwd() {
         to_show.forEach(el => {
             el.classList.add("shown");
         });
+
+        const to_hide = document.querySelectorAll(".no_pwd");
+        to_hide.forEach(el => {
+            el.classList.add("hidden");
+        });
+
         const buttons = document.querySelectorAll(".action button");
         buttons.forEach(btn => {
           const oldUrl= btn.getAttribute("hx-post");
           btn.setAttribute("hx-post", `${oldUrl}&pwd=${pwd}`);
         });
+
+        const pwd_el = document.getElementById("password");
+        pwd_el.innerHTML = pwd;
     }
 }
 
diff --git a/app/views/instance/show.html.erb b/app/views/instance/show.html.erb
index ab0a23c..28eff80 100644
--- a/app/views/instance/show.html.erb
+++ b/app/views/instance/show.html.erb
@@ -1,9 +1,19 @@
 <div id="public_id" data-content="<%= @instance.public_id %>"></div>
-<div hx-get="" hx-trigger="every 30s" hx-swap="innerHTML" hx-target="this">
+<div hx-get="" hx-trigger="every 30s" hx-swap="innerHTML" hx-select="#nm-list" hx-target="#nm-list">
   <header>
     <%= link_to root_path do %><img src="/icon.png" width="50" alt="eureka.coffee logo" /><% end %>
     <h1><span class="muted">instance</span> <%= @instance.name %></h1>
     <%= render partial: "zone_img", locals: { zone: @instance.zone, alt: @instance.zone, title: @instance.zone.upcase_first } %>
+    <div class="needs_pwd">
+      password: <span id="password">???</span>
+    </div>
+    <div class="no_pwd">
+      <%= form_with url: authenticate_to_instance_path do |form| %>
+        <%= form.text_field :password, placeholder: "enter password..." %>
+        <%= form.hidden_field :instance, value: @instance.public_id %>
+        <%= form.submit "submit" %>
+      <% end %>
+    </div>
   </header>
 
   <%= render partial: "list", locals: { instance: @instance } %>
diff --git a/config/routes.rb b/config/routes.rb
index 144da81..3a14c37 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -2,9 +2,10 @@ Rails.application.routes.draw do
   root "page#index"
 
   post "/new", to: "instance#create", as: :new_instance
-  get "/:public_id", to: "instance#show", as: :show_instance
   post "/pop", to: "instance#pop", as: :pop_in_instance
   post "/reset", to: "instance#reset", as: :reset_in_instance
+  post "/auth", to: "instance#authenticate", as: :authenticate_to_instance
+  get "/:public_id", to: "instance#show", as: :show_instance
 
   get "up" => "rails/health#show", as: :rails_health_check
 end