> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hackgate.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Set test credentials and instructions for researchers

> Provide researchers with login credentials and testing instructions directly through HackGATE so they have everything they need to begin.

Every HackGATE site has two plain-text fields — **Credentials** and **Instructions** — that researchers see when they access the proxied environment. Populating these fields before your pentest window starts ensures researchers can begin immediately without waiting for out-of-band communication.

## Fields

* **Credentials** — test account logins, API keys, or any other access details researchers need to authenticate with your application.
* **Instructions** — scope definition, rules of engagement, out-of-scope areas, and contact information for your security team.

<Tip>
  Include your vulnerability disclosure contact, expected response times, and any paths that are explicitly out of scope in the instructions field. Clear scope reduces noise and improves finding quality.
</Tip>

## Set up credentials and instructions

<Steps>
  <Step title="Create the site">
    [Create your HackGATE site](/sites/create) and note the `id` from the response. You need it for both requests below.
  </Step>

  <Step title="Set credentials">
    Send a `POST` request to `/api/sites/credentials` with the site `id` and the credentials text:

    ```bash theme={null}
    curl -X POST https://api-admin.hackgate.io/api/sites/credentials \
      -H "Authorization: Bearer <token>" \
      -H "Content-Type: application/json" \
      -d '{"id": "SITE_ID", "credentials": "Username: tester@example.com\nPassword: TestPass123!"}'
    ```
  </Step>

  <Step title="Set instructions">
    Send a `POST` request to `/api/sites/instructions` with the site `id` and the instructions text:

    ```bash theme={null}
    curl -X POST https://api-admin.hackgate.io/api/sites/instructions \
      -H "Authorization: Bearer <token>" \
      -H "Content-Type: application/json" \
      -d '{"id": "SITE_ID", "instructions": "Scope: all paths under /api. Out of scope: /admin. Report findings to security@example.com"}'
    ```
  </Step>

  <Step title="Enable the site">
    [Enable the site](/sites/enable-disable) so researchers can connect. They will see the credentials and instructions you set as soon as the proxy is live.
  </Step>
</Steps>

## Updating credentials and instructions

You can call either endpoint at any time to overwrite the current value. The update takes effect immediately — researchers will see the new content on their next page load. There is no version history; each call replaces the previous value.

## Request fields

| Field          | Type   | Description                                       |
| -------------- | ------ | ------------------------------------------------- |
| `id`           | string | The site ID.                                      |
| `credentials`  | string | Plain text credentials for researcher access.     |
| `instructions` | string | Plain text scope, rules, and contact information. |