# client.auth.sites

> client.auth.sites — the auth.sites operations.

`client.auth.sites` — the `auth.sites` operations.

On `AsyncKindgi` every method is the same, awaited.

## `client.auth.sites.enroll()`

```python signature
enroll(
    body: EnrollSiteBody | Mapping[str, Any] | None = None,
    /,
    *,
    timeout: float | None = None,
    **fields: Any,
) -> EnrollSiteResult
```

A site posts its public key with its enrollment code. `POST /v1/auth/sites/enroll`

Public: the code is the credential. The site keeps its private key; Kindgi stores the public one, and answers the site's id (its statements' `iss`) and the audience (their `aud`). A wrong, used or expired code, or one for a paused or unregistered site, gets one answer: `401 site-enrollment-refused`. Failures are limited per client (`429 rate-limit-exceeded`, with `Retry-After`). The body is at most 4096 bytes.