> Portal Navigation:
> 
> - Append `.md` to any URL under `https://dev.wix.com/docs/` to get its markdown version.
> - Pages are either content pages (article or reference text) or menu pages (a list of links to child pages).
> - To get a menu page, truncate any URL to a parent path and append `.md` (e.g. `https://dev.wix.com/docs/sdk.md`, `https://dev.wix.com/docs/sdk/core-modules.md`).
> - Top-level index of all portals: https://dev.wix.com/docs/llms.txt
> - Full concatenated docs: https://dev.wix.com/docs/llms-full.txt

## Resource: Make Admin API Calls with Client Credentials

## Article: Make Admin API Calls with Client Credentials

## Article Link: https://dev.wix.com/docs/go-headless/authentication/admin/make-admin-api-calls-with-client-credentials.md

## Article Content:

# Make Admin API Calls with Client Credentials

Client credentials are the recommended way to authorize [admin operations](https://dev.wix.com/docs/go-headless/authentication/admin/about-admin-operations.md) in a headless project: exchange your OAuth client ID and client secret for a short-lived access token using the OAuth `client_credentials` grant, then use that token to authorize your admin API calls.

Run this flow only in backend code, and validate who can trigger it.

> **Note:** If your project uses [Wix's Astro integration](https://dev.wix.com/docs/go-headless/wix-managed-headless/about-the-astro-integration.md), you don't manage credentials or tokens yourself. Instead, [elevate API call permissions](https://dev.wix.com/docs/go-headless/authentication/admin/elevate-api-call-permissions-with-the-astro-integration.md).

## Step 1 | Generate a client secret

The client secret authenticates your backend code as the project itself. Unlike the client ID used for visitor and member authentication, you need the client secret only for this flow.

<blockquote class="tip">

**Tip:** In a [Wix-managed headless project](https://dev.wix.com/docs/go-headless/wix-managed-headless/about-wix-managed-headless.md), your project's built-in client already has a secret. Run [`wix env pull`](https://dev.wix.com/docs/wix-cli/command-reference/project-commands/env-pull.md) to retrieve it as `WIX_CLIENT_SECRET`, along with your client ID, instead of generating one in the dashboard.

</blockquote>

To generate a client secret:

1. In your project dashboard, go to **Settings** > **Development & integrations** > [Headless Settings](https://www.wix.com/my-account/site-selector/?buttonText=Select%20Site&title=Select%20a%20Site&autoSelectOnSingleSite=true&actionUrl=https:%2F%2Fwww.wix.com%2Fdashboard%2F%7B%7BmetaSiteId%7D%7D%2Foauth-apps-settings).
2. Next to the relevant headless client, click the more actions menu to open that client's settings.
3. In the **Client info** section, under **Client secret**, click **Generate Client Secret**.
4. Copy the client secret and store it securely.

<blockquote class="important">

__Important:__ You can only view the client secret once, immediately after you generate it. If you lose it, you can run [`env pull`](https://dev.wix.com/docs/wix-cli/command-reference/project-commands/env-pull.md) to retrieve it. Store your client secret securely and only use it in backend code.

</blockquote>

## Step 2 | Get an access token

With your client ID and secret, call the [Create Access Token](https://dev.wix.com/docs/api-reference/app-management/oauth-2/create-access-token.md) method using the `client_credentials` grant type:

- `client_id`: Your client ID.
- `client_secret`: Your client secret.
- `grant_type`: `client_credentials`.

For example:

```bash
curl -X POST 'https://www.wixapis.com/oauth2/token' \
  -H 'Content-Type: application/json' \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "<CLIENT_ID>",
    "client_secret": "<CLIENT_SECRET>"
  }'
```

The response contains a short-lived access token:

```json
{
  "access_token": "<ACCESS_TOKEN>",
  "token_type": "Bearer",
  "expires_in": 14400
}
```

## Step 3 | Call an admin API

Pass the access token in the `Authorization` header of your admin API calls:

```bash
curl -X POST 'https://www.wixapis.com/stores/v3/products' \
  -H 'Authorization: <ACCESS_TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{ "product": { "name": "My product" } }'
```

The access token expires after 4 hours (14,400 seconds). When it expires, request a new one with the same `client_credentials` call.

## See also

- [About Admin Operations](https://dev.wix.com/docs/go-headless/authentication/admin/about-admin-operations.md)
- [Elevate API Call Permissions with the Astro Integration](https://dev.wix.com/docs/go-headless/authentication/admin/elevate-api-call-permissions-with-the-astro-integration.md)
- [Create Access Token](https://dev.wix.com/docs/api-reference/app-management/oauth-2/create-access-token.md)