An OAuth app is a site-level credential holder. Its id is the client_id (the two terms are interchangeable — Wix uses appId in provisioning responses, clientId in token requests, and id in the OAuth Apps API; they all refer to the same value).
When a headless site is provisioned it gets one OAuth app automatically (see Create Headless Site); use this recipe to create additional apps, inspect existing ones, or update their redirect configuration.
client_id is not a secret — it is a public identifier safe to embed in frontend code. The visitor token it mints is also non-privileged: it represents an anonymous visitor, not an admin. The client_secret is different — shown once in the Headless Settings dashboard, never returned by the API, and rotation is dashboard-only.
Endpoint: POST https://www.wixapis.com/oauth-app/v1/oauth-apps
Response:
id is the OAuth client_id. After creating the app, retrieve the client_secret from the Headless Settings dashboard.
Endpoint: GET https://www.wixapis.com/oauth-app/v1/oauth-apps/{id}
Endpoint: POST https://www.wixapis.com/oauth-app/v1/oauth-apps/query
Returns all OAuth apps for the site.
Endpoint: PATCH https://www.wixapis.com/oauth-app/v1/oauth-apps/{id}
Update requires an explicit mask.paths — omitting it silently updates nothing.
Updatable fields: name, description, loginUrl, logoutUrl, allowedRedirectUris, allowedRedirectDomains, technology.
| Field | Notes |
|---|---|
id | The OAuth client_id. Read-only. |
name | Required on create. 2–256 chars. |
loginUrl | External login redirect. Defaults to Wix login if omitted. |
logoutUrl | Called when the user logs out at Wix. |
allowedRedirectUris | Exact-match URIs for post-authentication redirect. Max 20. |
allowedRedirectDomains | Domain-level allow-list for non-auth redirects (e.g. checkout). Max 20. |
applicationType | WEB_APP, MOBILE, OTHER |
Once you have a client_id, frontends use it to mint an anonymous visitor token for buyer-facing API calls.
Endpoint: POST https://www.wixapis.com/oauth2/token
Use the access_token as the Authorization header on subsequent API calls.
Never re-mint anonymous on every load. The visitor token is the cart/session identity — a fresh anonymous mint creates a new visitor and silently empties the cart. Persist the refresh_token and use it to renew.
Last updated: 28 September 2026