About HTTP Endpoints

Wix CLI projects support HTTP endpoints, which you use to build backend APIs for handling HTTP requests and coordinating frontend and backend logic. HTTP endpoints can serve any kind of data.

File-based routing

The location of an endpoint file in your project determines its URL. Place a file at src/pages/api/<name>.ts, and it's exposed at /api/<name>. For example, src/pages/api/users.ts becomes the route /api/users.

Endpoints are auto-discovered from the filesystem, so they aren't registered in src/extensions.ts and aren't generated by npm run generate.

HTTP method handlers

Each endpoint file exports one or more HTTP method handlers, such as GET or POST. A handler receives the standard web Request and returns a standard Response, so you can return any content type, including JSON, plain text, images, and RSS feeds.

Handlers use the APIRoute type from astro, the underlying framework that powers HTTP endpoints.

Server-side runtime

Endpoints run on the server, not in the browser. This means you can:

• Read environment variables, including secret server variables that aren't exposed to the client.
• Call external services without exposing credentials in your frontend bundle.

Calling endpoints from frontend extensions

Frontend extensions, like dashboard pages and site widgets, call endpoints using httpClient.fetchWithAuth() from @wix/essentials. This attaches the current user's access token to the request as an Authorization header, which the endpoint can then use to make elevated SDK calls for operations the user can't perform directly.

For the full pattern, see Add HTTP Endpoints to Your Project.

Permissions and security

Unlike web methods, HTTP endpoints don't have a built-in permissions model. An endpoint is reachable by anyone who knows its URL, so enforcing access control is your responsibility.

To restrict access, inspect the caller's access token in your handler and decide whether to proceed:

• Frontend extensions send the current user's token when they call your endpoint with httpClient.fetchWithAuth().
• In the handler, use Get Token Info from @wix/essentials to read the token's subjectType, for example, to allow only site members or admins.

Without fetchWithAuth() on the client, no token is sent and Get Token Info has nothing to inspect.

Use cases

Use HTTP endpoints when you need to:

• Integrate with external APIs or services that require HTTP requests.
• Handle complex form submissions or file uploads.
• Serve dynamic content like images, RSS feeds, or personalized data.
• Build REST APIs with multiple HTTP methods.
• Access runtime data or server-side databases.

See also

• Add HTTP Endpoints to Your Project
• Elevate API Call Permissions
• About Environment Variables
• Migrate from HTTP Functions to HTTP Endpoints
• Migrate from Web Methods to HTTP Endpoints