Handle Visitors Using the REST API

In order to handle anonymous visitor sessions you need to generate, manage, and use visitor tokens. Use these tokens when making requests to Wix APIs on behalf of a visitor to maintain the visitor's session.

Step 1 | Generate new visitor tokens

Generate new visitor tokens using the Token endpoint.

When calling the Token endpoint, send the following parameters:

• clientId: The Client ID of your OAuth app, which can be found in your project's Headless Settings.
• grantType: Set as "anonymous" to get visitor tokens.

The Token endpoint responds with:

• access_token: An access token used to authorize API calls.
• expires_in: The number of seconds before the access token expires. Access tokens expire after 4 hours (14,400 seconds).
• refresh_token: A refresh token used to get a new access token.

Once you have tokens, you can use them to make authenticated calls to APIs on behalf of the current visitor.

Step 2 | Store tokens for later

If you want to be able to restore the current session at some point later, store your visitor tokens locally, for example in localStorage, a cookie, or a local file.

For example, after generating a visitor token, you can store it in a cookie with a max age of 4 hours. Then, before making API calls, try reading the token from the cookie.

• If the cookie still exists, you can use the access token you stored in the cookie to make the API call.
• If the cookie no longer exists, you can use your refresh token to renew your visitor tokens, and then make the API call with the new access token.

Renew visitor tokens

To renew visitor tokens, call the Token endpoint again, this time with the following parameters:

• refresh_token: The refresh token returned from the previous call to the Token endpoint.
• grantType: Set as "refresh_token" to get renewed visitor tokens based off your current refresh token.

The Token endpoint responds with:

• access_token: An access token used to authorize API calls.
• expires_in: The number of seconds before the access token expires. Access tokens expire after 4 hours (14,400 seconds).
• refresh_token: A refresh token used to get a new access token.

See also

• About Handling Visitors