> Portal Navigation:
> 
> - Append `.md` to any URL under `https://dev.wix.com/docs/` to get its markdown version.
> - Pages are either content pages (article or reference text) or menu pages (a list of links to child pages).
> - To get a menu page, truncate any URL to a parent path and append `.md` (e.g. `https://dev.wix.com/docs/sdk.md`, `https://dev.wix.com/docs/sdk/core-modules.md`).
> - Top-level index of all portals: https://dev.wix.com/docs/llms.txt
> - Full concatenated docs: https://dev.wix.com/docs/llms-full.txt

## Resource: Introduction

## Article: Introduction

## Article Link: https://dev.wix.com/docs/api-reference/app-management/oauth-2/introduction.md

## Article Content:

# About the OAuth 2 API

The OAuth 2 API allows your app to manage tokens that you can use to authenticate
Wix API calls. By default, OAuth authentication follows the [OAuth Client Credentials protocol](https://oauth.net/2/grant-types/client-credentials/).

With the OAuth 2 API, you can:

+ Create access tokens for OAuth.
+ Request an access token for custom authentication (legacy).
+ Refresh an access token for custom authentication (legacy).
+ Get information about a specific access token.

Learn more:
+ [About OAuth](https://dev.wix.com/docs/build-apps/develop-your-app/access/authentication/about-oauth.md)
+ [How to authenticate using OAuth](https://dev.wix.com/docs/build-apps/develop-your-app/access/authentication/authenticate-using-oauth.md)

## Before you begin

It's important to note the following points before starting to code:

+ If your app uses OAuth to authenticate Wix API calls,
   you must create access tokens by calling
   [Create Access Token](https://dev.wix.com/docs/api-reference/app-management/oauth-2/create-access-token.md).
+ If your app uses custom authentication, Wix sends you an authorization code while redirecting new users to your app URL. You must use this authorization code within 10 minutes to create a refresh token by calling [Request an Access Token](https://dev.wix.com/docs/api-reference/app-management/oauth-2/request-an-access-token.md). If the process fails, you're unable to retrieve access tokens with [Refresh an Access Token](https://dev.wix.com/docs/api-reference/app-management/oauth-2/refresh-an-access-token.md). From the site owner's point-of-view, it seems that the app installation has succeeded. You have 2 options in this situation: Ask the site owners to re-install your app, or fall back to retrieving access tokens with the OAuth strategy by calling [Create Access Token](https://dev.wix.com/docs/api-reference/app-management/oauth-2/create-access-token.md).

<blockquote class="caution">

**Caution:** Custom authentication (legacy) is no longer available for new apps. Existing apps that already use custom authentication can continue to do so. For details, see [Custom Authentication (Legacy)](https://dev.wix.com/docs/build-apps/develop-your-app/access/authentication/custom-authentication-legacy.md).

</blockquote>

## Terminology

+ __OAuth__: Authorization protocol used by Wix to allow third-party apps to securely obtain access to Wix APIs.
+ __Access token__: A string used in the `"authorization"` header to make authenticated calls to Wix APIs. All Wix access tokens are of type `"Bearer"`. Learn more about [access token types](https://oauth.net/2/access-tokens/).
+ __Custom authentication (legacy)__: A legacy version of the OAuth protocol used by Wix. This method is only applicable if your app needs to redirect users to a URL outside the Wix ecosystem during the app installation process. **Note:** Custom authentication is no longer available for new apps.
+ __Authorization code__: A temporary string sent by Wix to your app during the custom authentication process, after a user completes the installation and grants your app the necessary permissions. The authorization code expires in 10 minutes. Use it to generate a refresh token before it expires.
+ __Refresh token__: A persistent string used by your app to generate access tokens in the custom authentication process. The refresh token does not expire. Store it securely and never share or expose it publicly.

@sdk_package_setup