diff --git a/master.js b/master.js
index b87b7d27..7c4725e0 100644
--- a/master.js
+++ b/master.js
@@ -440,37 +440,64 @@ app.post("/api/uploadMod", authenticate.middleware, function(req,res) {
     }
 });
 /**
+Prepare the slaveCache for both /api/slaves calls
+*/
+let slaveCache = {
+	timestamp: Date.now(),
+};
+function getSlaves() {
+	if(!slaveCache.cache || Date.now() - slaveCache.timestamp > 5000) {
+		let copyOfSlaves = JSON.parse(JSON.stringify(slaves));
+		slaveCache.cache = copyOfSlaves;
+		slaveCache.timestamp = Date.now();
+	}
+	return slaveCache;
+}
+/**
 GET endpoint for getting information about all our slaves
 @memberof clusterioMaster
 @instance
 @alias /api/slaves
 */
-let slaveCache = {
-	timestamp: Date.now(),
-};
 app.get("/api/slaves", function(req, res) {
 	endpointHitCounter.labels(req.route.path).inc();
 	res.header("Access-Control-Allow-Origin", "*");
 	res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
-	if(!slaveCache.cache || Date.now() - slaveCache.timestamp > 5000){
-		let copyOfSlaves = JSON.parse(JSON.stringify(slaves));
-		// filter out the rcon password because thats kindof not a safe thing to share
-		for(key in copyOfSlaves){
-			copyOfSlaves[key].rconPassword = "hidden";
-		}
-		slaveCache.cache = copyOfSlaves;
-		slaveCache.timestamp = Date.now();
+	let slaveCache = getSlaves();
+	for(key in slaveCache) {
+		slaveCache[key].rconPassword = "hidden";
 	}
-	
 	res.send(slaveCache.cache);
 });
-var recievedItemStatisticsBySlaveID = {};
-var sentItemStatisticsBySlaveID = {};
+/**
+POST endpoint for getting information about all our slaves, requires auth, responds including RCON passwords
+@memberof clusterioMaster
+@instance
+@alias /api/slaves
+*/
+app.post("/api/slaves", function(req, res) {
+	let token = req.headers['x-access-token'];
+	if(!token) {
+		return res.status(401).send({ auth: false, message: 'No token provided.' });
+	}
+	jwt.verify(token, config.masterAuthSecret, function(err, decoded) {
+		if(err) {
+			return res.status(500).send({ auth: false, message: 'Failed to authenticate token.' });
+		}
+		endpointHitCounter.labels(req.route.path).inc();
+		res.header("Access-Control-Allow-Origin", "*");
+		res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
+		let slaveCache = getSlaves();
+		res.send(slaveCache.cache);
+	});
+});
 /*
 var recievedItemStatistics = new averagedTimeSeries({
 	maxEntries: config.itemStats.maxEntries,
 	entriesPerSecond: config.itemStats.entriesPerSecond,
 }, console.log);*/
+var recievedItemStatisticsBySlaveID = {};
+var sentItemStatisticsBySlaveID = {};
 // 
 /**
 POST endpoint for storing items in master's inventory.