Client credentials are the recommended way to authorize admin operations in a headless project: exchange your OAuth client ID and client secret for a short-lived access token using the OAuth client_credentials grant, then use that token to authorize your admin API calls.
Run this flow only in backend code, and validate who can trigger it.
Note: If your project uses Wix's Astro integration, you don't manage credentials or tokens yourself. Instead, elevate API call permissions.
The client secret authenticates your backend code as the project itself. Unlike the client ID used for visitor and member authentication, you need the client secret only for this flow.
Tip: In a Wix-managed headless project, your project's built-in client already has a secret. Run wix env pull to retrieve it as WIX_CLIENT_SECRET, along with your client ID, instead of generating one in the dashboard.
To generate a client secret:
Important: You can only view the client secret once, immediately after you generate it. If you lose it, you can run env pull to retrieve it. Store your client secret securely and only use it in backend code.
With your client ID and secret, call the Create Access Token method using the client_credentials grant type:
client_id: Your client ID.client_secret: Your client secret.grant_type: client_credentials.For example:
The response contains a short-lived access token:
Pass the access token in the Authorization header of your admin API calls:
The access token expires after 4 hours (14,400 seconds). When it expires, request a new one with the same client_credentials call.
Last updated: 22 July 2026