diff --git a/src/client/settings.go b/src/client/settings.go
index d001753..4983e19 100644
--- a/src/client/settings.go
+++ b/src/client/settings.go
@@ -1,9 +1,12 @@
 package client
 
 import (
+	"encoding/json"
 	"fmt"
 	"net/http"
 
+	"github.com/ihexxa/quickshare/src/db/sitestore"
+	"github.com/ihexxa/quickshare/src/handlers/settings"
 	"github.com/parnurzeal/gorequest"
 )
 
@@ -28,3 +31,26 @@ func (cl *SettingsClient) Health() (*http.Response, string, []error) {
 	return cl.r.Options(cl.url("/v1/settings/health")).
 		End()
 }
+
+func (cl *SettingsClient) GetClientCfg(token *http.Cookie) (*http.Response, *settings.ClientCfgMsg, []error) {
+	resp, body, errs := cl.r.Get(cl.url("/v1/settings/client")).
+		AddCookie(token).
+		End()
+
+	mResp := &settings.ClientCfgMsg{}
+	err := json.Unmarshal([]byte(body), mResp)
+	if err != nil {
+		errs = append(errs, err)
+		return nil, nil, errs
+	}
+	return resp, mResp, nil
+}
+
+func (cl *SettingsClient) SetClientCfg(cfg *sitestore.ClientConfig, token *http.Cookie) (*http.Response, string, []error) {
+	return cl.r.Patch(cl.url("/v1/settings/client")).
+		AddCookie(token).
+		Send(&settings.ClientCfgMsg{
+			ClientCfg: cfg,
+		}).
+		End()
+}
diff --git a/src/client/web/src/client/files.ts b/src/client/web/src/client/files.ts
index 9f069da..6940dd9 100644
--- a/src/client/web/src/client/files.ts
+++ b/src/client/web/src/client/files.ts
@@ -14,6 +14,7 @@ const listDirQuery = "dp";
 
 function translateResp(resp: Response<any>): Response<any> {
   if (resp.status === 500) {
+    // TODO: replace following with error code
     if (
       resp.data == null ||
       resp.data === "" ||
diff --git a/src/client/web/src/client/index.ts b/src/client/web/src/client/index.ts
index 9e42080..f34b1d3 100644
--- a/src/client/web/src/client/index.ts
+++ b/src/client/web/src/client/index.ts
@@ -65,6 +65,17 @@ export interface ListSharingsResp {
   sharingDirs: string[];
 }
 
+export interface ClientConfig {
+  siteName: string;
+  siteDesc: string;
+  bg: {
+    url: string;
+    repeat: string;
+    position: string;
+    align: string;
+  };
+}
+
 export interface IUsersClient {
   login: (
     user: string,
@@ -110,6 +121,12 @@ export interface IFilesClient {
   generateHash: (filePath: string) => Promise<Response>;
 }
 
+export interface ISettingsClient {
+  health: () => Promise<Response>;
+  getClientCfg: () => Promise<Response>;
+  setClientCfg: (cfg: ClientConfig) => Promise<Response>;
+}
+
 export interface Response<T = any> {
   status: number;
   statusText: string;
diff --git a/src/handlers/multiusers/handlers.go b/src/handlers/multiusers/handlers.go
index 055bbb2..5b80ed2 100644
--- a/src/handlers/multiusers/handlers.go
+++ b/src/handlers/multiusers/handlers.go
@@ -12,9 +12,9 @@ import (
 	"github.com/ihexxa/gocfg"
 	"golang.org/x/crypto/bcrypt"
 
+	"github.com/ihexxa/quickshare/src/db/userstore"
 	"github.com/ihexxa/quickshare/src/depidx"
 	q "github.com/ihexxa/quickshare/src/handlers"
-	"github.com/ihexxa/quickshare/src/db/userstore"
 )
 
 var (
@@ -63,6 +63,8 @@ func NewMultiUsersSvc(cfg gocfg.ICfg, deps *depidx.Deps) (*MultiUsersSvc, error)
 		apiRuleCname(userstore.AdminRole, "DELETE", "/v1/fs/uploadings"):      true,
 		apiRuleCname(userstore.AdminRole, "GET", "/v1/fs/metadata"):           true,
 		apiRuleCname(userstore.AdminRole, "OPTIONS", "/v1/settings/health"):   true,
+		apiRuleCname(userstore.AdminRole, "GET", "/v1/settings/client"):       true,
+		apiRuleCname(userstore.AdminRole, "PATCH", "/v1/settings/client"):     true,
 		apiRuleCname(userstore.AdminRole, "GET", "/v1/captchas/"):             true,
 		apiRuleCname(userstore.AdminRole, "GET", "/v1/captchas/imgs"):         true,
 		apiRuleCname(userstore.AdminRole, "POST", "/v1/fs/sharings"):          true,
@@ -70,7 +72,6 @@ func NewMultiUsersSvc(cfg gocfg.ICfg, deps *depidx.Deps) (*MultiUsersSvc, error)
 		apiRuleCname(userstore.AdminRole, "GET", "/v1/fs/sharings"):           true,
 		apiRuleCname(userstore.AdminRole, "GET", "/v1/fs/sharings/exist"):     true,
 		apiRuleCname(userstore.AdminRole, "POST", "/v1/fs/hashes/sha1"):       true,
-
 		// user rules
 		apiRuleCname(userstore.UserRole, "GET", "/"):                       true,
 		apiRuleCname(userstore.UserRole, "GET", publicPath):                true,
@@ -93,6 +94,7 @@ func NewMultiUsersSvc(cfg gocfg.ICfg, deps *depidx.Deps) (*MultiUsersSvc, error)
 		apiRuleCname(userstore.UserRole, "DELETE", "/v1/fs/uploadings"):    true,
 		apiRuleCname(userstore.UserRole, "GET", "/v1/fs/metadata"):         true,
 		apiRuleCname(userstore.UserRole, "OPTIONS", "/v1/settings/health"): true,
+		apiRuleCname(userstore.UserRole, "GET", "/v1/settings/client"):     true,
 		apiRuleCname(userstore.UserRole, "GET", "/v1/captchas/"):           true,
 		apiRuleCname(userstore.UserRole, "GET", "/v1/captchas/imgs"):       true,
 		apiRuleCname(userstore.UserRole, "POST", "/v1/fs/sharings"):        true,
@@ -109,6 +111,7 @@ func NewMultiUsersSvc(cfg gocfg.ICfg, deps *depidx.Deps) (*MultiUsersSvc, error)
 		apiRuleCname(userstore.VisitorRole, "GET", "/v1/fs/files"):            true,
 		apiRuleCname(userstore.VisitorRole, "GET", "/v1/fs/dirs"):             true,
 		apiRuleCname(userstore.VisitorRole, "OPTIONS", "/v1/settings/health"): true,
+		apiRuleCname(userstore.VisitorRole, "GET", "/v1/settings/client"):     true,
 		apiRuleCname(userstore.VisitorRole, "GET", "/v1/captchas/"):           true,
 		apiRuleCname(userstore.VisitorRole, "GET", "/v1/captchas/imgs"):       true,
 		apiRuleCname(userstore.VisitorRole, "GET", "/v1/fs/sharings/exist"):   true,
diff --git a/src/handlers/settings/handlers.go b/src/handlers/settings/handlers.go
index 786c3e2..539489e 100644
--- a/src/handlers/settings/handlers.go
+++ b/src/handlers/settings/handlers.go
@@ -7,6 +7,7 @@ import (
 	"github.com/ihexxa/gocfg"
 
 	"github.com/ihexxa/quickshare/src/db/sitestore"
+	"github.com/ihexxa/quickshare/src/db/userstore"
 	"github.com/ihexxa/quickshare/src/depidx"
 	q "github.com/ihexxa/quickshare/src/handlers"
 )
@@ -55,6 +56,12 @@ func (h *SettingsSvc) SetClientCfg(c *gin.Context) {
 		return
 	}
 
+	role := c.MustGet(q.RoleParam).(string)
+	if role != userstore.AdminRole {
+		c.JSON(q.ErrResp(c, 401, q.ErrUnauthorized))
+		return
+	}
+
 	err = h.deps.SiteStore().SetClientCfg(req.ClientCfg)
 	if err != nil {
 		c.JSON(q.ErrResp(c, 500, err))