This page is a lookup for the auth decisions you make while building, once you already understand the core concepts. It doesn't explain how auth works. Instead, it collects the answers in one place so you can find them fast.
Read it in whichever direction matches your question:
For the concepts behind these tables, see Auth on the Wix Platform, Identities, and Authentication Methods.
Use this table when you know what kind of project you're building. It shows what you're responsible for setting up and which identities calls can run as on that path.
| Development path | Authentication | Available identities |
|---|---|---|
| Sites | Host auth, automatic | Visitor, member, Wix user |
| Wix-managed headless | OAuth, automatic with the Astro integration | Visitor, member, Wix user, Wix app |
| Self-managed headless | OAuth and API keys, you configure | Visitor, member, Wix app, API key admin |
| Wix-managed apps | Host auth and OAuth, automatic | Visitor, member, Wix user, Wix app |
| Self-managed apps | Host auth and OAuth, you configure | Visitor, member, Wix user, Wix app |
| Blocks apps | Host auth, automatic | Visitor, member, Wix user, Wix app |
On every development path, backend code can elevate a call (elevated() in the SDK) to perform an operation the caller isn't authorized for.
Note: In Wix-managed headless, Wix hosts your frontend, but authentication is automatic only with Wix's Astro integration. A Wix-managed project that brings its own frontend handles authentication itself, like self-managed headless.
Use this table when you know the situation your code is in and need to know what the call runs as and how to authenticate it. Rows run roughly from code inside a Wix host to code running fully outside it. The REST auth and SDK auth columns are two ways to do the same thing, so use the one that matches your stack.
| Scenario | Identity | REST auth | SDK auth |
|---|---|---|---|
| On a Wix site (frontend or web method) | Visitor or member | Automatic | Automatic |
| In a dashboard or editor | Wix user | Not supported | Automatic |
| External visitor session | Visitor | OAuth anonymous | OAuthStrategy |
| External member session | Member | OAuth authorization_code | OAuthStrategy |
| Backend runs as the app (API calls, event handlers, scheduled jobs) | Wix app | OAuth client_credentials | AppStrategy |
| External admin automation, no session | API key admin | API key | ApiKeyStrategy |
Note: Inside a Wix host, authentication is automatic and you don't create a Wix client. Self-managed apps that run on a site authenticate a client with the host module. Acting as a Wix user is SDK-only.
Last updated: 2 August 2026