diff --git a/app/Http/Controllers/CompanyController.php b/app/Http/Controllers/CompanyController.php
index af8bb9522ece..25800eae7ecd 100644
--- a/app/Http/Controllers/CompanyController.php
+++ b/app/Http/Controllers/CompanyController.php
@@ -69,11 +69,12 @@ class CompanyController extends BaseController
      */
     public function __construct(CompanyRepository $company_repo)
     {
+        
         parent::__construct();
 
         $this->company_repo = $company_repo;
 
-        // $this->middleware('password_protected')->only(['destroy']);
+        $this->middleware('password_protected')->only(['destroy']);
 
     }
 
diff --git a/app/Http/Middleware/PasswordProtection.php b/app/Http/Middleware/PasswordProtection.php
index 54163fac473c..fdcbfd3dfdf1 100644
--- a/app/Http/Middleware/PasswordProtection.php
+++ b/app/Http/Middleware/PasswordProtection.php
@@ -52,7 +52,8 @@ class PasswordProtection
             $x_api_password = base64_decode($request->header('X-API-PASSWORD-BASE64'));
         }
 
-        if (Cache::get(auth()->user()->hashed_id.'_'.auth()->user()->account_id.'_logged_in')) {
+        // If no password supplied - then we just check if their authentication is in cache //
+        if (Cache::get(auth()->user()->hashed_id.'_'.auth()->user()->account_id.'_logged_in') && !$x_api_password) {
 
             Cache::put(auth()->user()->hashed_id.'_'.auth()->user()->account_id.'_logged_in', Str::random(64), $timeout);
 
diff --git a/routes/api.php b/routes/api.php
index 38ac51ac3863..0eceb6ef2aba 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -47,7 +47,9 @@ Route::group(['middleware' => ['api_db', 'token_auth', 'locale'], 'prefix' => 'a
 
     Route::post('companies/purge/{company}', 'MigrationController@purgeCompany')->middleware('password_protected');
     Route::post('companies/purge_save_settings/{company}', 'MigrationController@purgeCompanySaveSettings')->middleware('password_protected');
+    
     Route::resource('companies', 'CompanyController'); // name = (companies. index / create / show / update / destroy / edit
+    
     Route::put('companies/{company}/upload', 'CompanyController@upload');
 
     Route::get('company_ledger', 'CompanyLedgerController@index')->name('company_ledger.index');