diff --git a/routers/routes/routes.go b/routers/routes/routes.go
index 4f1f6f314..16dcbacda 100755
--- a/routers/routes/routes.go
+++ b/routers/routes/routes.go
@@ -21,11 +21,13 @@ import (
 	"code.gitea.io/gitea/modules/options"
 	"code.gitea.io/gitea/modules/public"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/templates"
 	"code.gitea.io/gitea/modules/validation"
 	"code.gitea.io/gitea/routers"
 	"code.gitea.io/gitea/routers/admin"
 	apiv1 "code.gitea.io/gitea/routers/api/v1"
+	apiAdmin "code.gitea.io/gitea/routers/api/v1/admin"
 	"code.gitea.io/gitea/routers/dev"
 	"code.gitea.io/gitea/routers/events"
 	"code.gitea.io/gitea/routers/org"
@@ -1125,6 +1127,11 @@ func RegisterRoutes(m *macaron.Macaron) {
 		apiv1.RegisterRoutes(m)
 	}, handlers...)
 
+	//secure api,
+	m.Group("/secure", func() {
+		m.Post("/user", bindIgnErr(structs.CreateUserOption{}), apiAdmin.CreateUser)
+	}, reqBasicAuth)
+
 	m.Group("/api/internal", func() {
 		// package name internal is ideal but Golang is not allowed, so we use private as package name.
 		private.RegisterRoutes(m)