diff --git a/lib/bcoin/http/server.js b/lib/bcoin/http/server.js
index cec1d7f4..bafb4c8d 100644
--- a/lib/bcoin/http/server.js
+++ b/lib/bcoin/http/server.js
@@ -137,6 +137,7 @@ HTTPServer.prototype._init = function _init() {
 
     if (req.method === 'POST'
         && req.pathname === '/') {
+      req.options = {};
       if (self.apiKey) {
         assert(utils.isHex(req.password), 'API key must be a hex string.');
         assert(req.password.length === 64, 'API key must be 32 bytes.');
@@ -262,6 +263,11 @@ HTTPServer.prototype._init = function _init() {
   });
 
   this.use(function(req, res, next, send) {
+    if (req.method === 'POST'
+        && req.pathname === '/') {
+      return next();
+    }
+
     if (self.apiKey) {
       if (!utils.ccmp(req.options.apiKey, self.apiKey)) {
         send(403, { error: 'Forbidden.' });