Authentication and authorization together govern access to Wix APIs. Authentication establishes who is calling. Authorization determines whether that identity is allowed to perform the requested action, based on its scopes and roles.
Wix's auth model has several parts. Together, they determine whether an API call is allowed to run.
- Identity: The actor the call runs as, such as a visitor, member, Wix user, Wix app, or API key admin. Where the code runs shapes which identity a call gets. For example, a call made from a site runs as the current visitor or member, while a call made from the dashboard runs as a Wix user.
- Authentication method: How the call proves that identity to Wix. There are three methods: OAuth, API keys, and host auth. Which method a call uses depends on the identity it needs and where the code runs.
- Permissions: Whether the identity is allowed to invoke the API method being called, based on its scopes and role.
- Elevation: When the identity lacks the permissions a method requires, elevation lets backend code run that one call with higher permissions, without changing the identity the rest of your code uses.
For a side-by-side map of which identity uses which authentication method and token, see Auth Quick Reference.
The development path determines how you set up auth:
- Sites: Wix handles authentication automatically for frontend, backend, and dashboard code. You don't configure tokens.
- Wix-managed headless projects: With Wix's Astro integration, Wix handles the baseline token exchange and your code calls the SDK with the resolved caller identity. With any other framework, you handle authentication yourself, as in self-managed headless.
- Self-managed headless projects: You manage authentication directly. The right method depends on the identity and operation. See Authentication Methods.
- Wix-managed apps: Wix handles the baseline token exchange, and your code calls the SDK with the resolved caller identity.
- Self-managed apps: You manage authentication directly. The right method depends on the identity and operation. See Authentication Methods.
- Blocks apps: Wix handles authentication automatically. The auth model is the same as for Wix-managed apps.
Every development path supports elevation, which lets backend code run a single call with higher permissions than the current identity. The mechanics differ by path.
For the identity and authentication method behind common build scenarios, see Auth Quick Reference.