Admin operations are backend API calls that need more permissions than the current visitor or member has, such as creating members, updating inventory, issuing refunds, or querying all orders across your project.
Use admin operations to perform actions that affect data beyond the current visitor's session. For example:
Run admin operations only in backend code, and validate who can trigger them.
How you authorize admin operations depends on your setup, with one exception: for admin access beyond your project's own site, such as account-level operations or external integrations, use an API key regardless of setup. Otherwise:
If your project uses the Astro integration, you don't manage credentials or tokens yourself. @wix/essentials handles authenticating as the project. Wrap a restricted SDK method with auth.elevate() and call the elevated version. Learn how in Elevate API Call Permissions with the Astro Integration.
Warning: Elevation lets your code call methods it typically can't access. Use it intentionally and only in backend code. Pay special attention when using elevate() in backend code that can be triggered from the frontend or exposed to outside callers.
A headless project is its own Wix app, and it can authenticate as itself: exchange your OAuth client ID and client secret for a short-lived access token, then use that token to authorize your admin API calls. Learn how in Make Admin API Calls with Client Credentials.
An API key represents administrative access to your Wix account, with a custom set of permissions. Use one when your access needs to reach beyond your project's own site, such as account-level operations or external integrations. You can also use an API key instead of client credentials for admin calls within a self-managed headless project.
Important: Store your API keys securely and only use them in backend code.
Last updated: 22 July 2026