In self-managed headless projects, you must handle authentication manually. This article explains the identities and authentication strategies you need to implement.
Note In Wix-managed headless, the CLI handles visitor and member authentication automatically. You don't need to configure OAuth or manage tokens yourself.
When you call a Wix API from your headless project, it's called by a specific identity.
Wix restricts some methods based on which identities can call them. Authorization notes in the API reference indicate when an identity restricts a method.
A headless project can use the following identities:
Operations that access or manage information relating to a current site visitor, such as adding items to the current visitor's cart, require OAuth. With OAuth, your site or app can recognize individual visitors and members using tokens to access their data.
Note: OAuth for Wix Headless only requires a client ID. It doesn't require a client secret.
For API calls that require administrative access, use an API key. With a Wix API key, you can grant a custom set of permissions to a site or app for accessing or managing business data, including members, orders, products, events, bookings, and more.
Unlike visitor and member authentication, API key authentication works the same in both self-managed and Wix-managed headless projects.
Learn more about admin operations.