In self-managed headless projects, you must handle authentication manually. This article explains the identities and authentication strategies you need to implement.
Note: In Wix-managed headless, if you build with Wix's Astro integration, the CLI handles visitor and member authentication automatically, so you don't configure OAuth or manage tokens yourself. With any other framework, you set up authentication as described here.
When you call a Wix API from your headless project, it's called by a specific identity.
Wix restricts some methods based on which identities can call them. Authorization notes in the API reference indicate when an identity restricts a method.
A headless project can use the following identities:
Operations that access or manage information relating to a current site visitor, such as adding items to the current visitor's cart, require OAuth. With OAuth, your site or app can recognize individual visitors and members using tokens to access their data.
Note: OAuth for Wix Headless only requires a client ID. It doesn't require a client secret.
For API calls that require administrative access, use an API key. With a Wix API key, you can grant a custom set of permissions to a site or app for accessing or managing business data, including members, orders, products, events, bookings, and more.
Learn more about admin operations.
Last updated: 25 June 2026