Authentication Methods

An authentication method is the mechanism a caller uses to prove their identity to Wix. Different methods suit different identities, contexts, and development paths. Sometimes Wix takes care of authentication automatically. Other times, you handle it explicitly.

Wix supports three authentication methods:

• OAuth: Used when your code runs outside the Wix dashboard, editor, or site and needs to authenticate as a visitor, member, or Wix app.
• API keys: Used for site-level or account-level administrative access without an app context, such as partner workflows, external integrations, and server-to-server automation.
• Host auth: Used when your code runs in the Wix dashboard, editor, or on a Wix site. Wix manages the authentication for you.

Some projects use more than one method. For example, an app may rely on host auth in its frontend extensions and OAuth in its backend code.

Always choose the least-privileged method that still supports the requirements shown in the API Reference. If an API method requires more authorization than the caller has, you may be able to elevate that call in backend code instead of switching to a more privileged authentication method.

This article covers the three methods at a conceptual level. For the REST-specific details, see REST API Authentication. For the SDK-specific details, see Set Up a Wix Client.

OAuth

OAuth is the method for code running outside the Wix dashboard, editor, or site. Your code presents an OAuth token to call Wix APIs as a specific identity.

OAuth supports three identities, each obtained with its own grant type:

• Visitor: The anonymous grant. For code acting as an anonymous individual, such as browsing public content.
• Member: The authorization_code grant, issued after a login redirect. For code acting as a logged-in individual.
• Wix app: The client_credentials grant, using a client ID and secret. For an installed app acting with its granted scopes, or a headless project's OAuth client acting as itself.

OAuth tokens are short-lived and sent in the Authorization header of REST requests. The JavaScript SDK handles token acquisition and refresh automatically through its OAuthStrategy (visitor and member) and AppStrategy (Wix app) authorization strategies.

Token lifetime

OAuth access tokens are short-lived, valid for 4 hours whether obtained via REST or the SDK. How a token is renewed depends on its type:

• Visitor and member tokens come with a refresh token, valid for 365 days by default and rotated on each use, so a session can be renewed without the user logging in again. The SDK handles this automatically.
• App tokens (client_credentials) have no refresh token. A new token is minted from the same client ID and secret when the old one expires.

For the REST-specific renewal steps, see REST API Authentication.

API keys

An API key is a long-lived credential for site-level or account-level administrative access, without an app or user session. It stays valid until you revoke or rotate it in the Wix dashboard. A key's permissions combine two independent dimensions:

• Scopes define which operations the key can perform.
• Site access defines which sites the key can target: all sites in the account, or specific sites only. A call that targets a site outside a key's site access is rejected, regardless of its scopes.

As a best practice, restrict each key to the narrowest set of sites its integration needs.

Every call made with a key must identify its target: an account ID for account-level operations, or a site ID for site-level operations. Account owners and co-owners can create keys.

When to use API keys

Use API keys for administrative access that isn't tied to a user session, such as:

• Server-to-server automation and scripting, such as CI/CD pipelines and GitHub Actions.
• External integrations with third-party tools that call Wix APIs on your behalf.
• AI agents and MCP server connections that need access to your Wix account or site.
• Admin operations in a headless project that reach beyond the project's own site, such as account-level operations.
• Managing admin operations across multiple sites in Channel and Enterprise accounts.

For admin operations scoped to a headless project's own site, use the OAuth client_credentials flow instead.

For REST implementation details, see Generate an API Key and Make API Calls with an API Key. The JavaScript SDK implements API key authentication through its ApiKeyStrategy.

Host auth

Host auth is the method for code running inside a Wix host: the dashboard, editor, or a Wix site. The host authenticates its calls for you, so you never fetch tokens or manage credentials. Your identity comes from where the code runs.

How you connect depends on how you build:

• Extending Wix sites: Authentication is fully automatic. You just call Wix APIs.
• App and headless extensions: You create a Wix client with the relevant host module (dashboard, editor, or site) to pass the host's identity to your calls.

Either way, the host manages the tokens, not your code.

When to use host auth

• Your code runs in a dashboard extension, acting as a Wix user.
• Your code runs in an editor extension, acting as a Wix user.
• Your code runs on a Wix site, acting as a visitor or member.

Authentication methods across development paths

How you set up authentication depends on your development path:

• Sites: Host auth, applied automatically. You don't choose or configure a method.
• Wix-managed headless projects: Wix's Astro integration handles the OAuth token exchange automatically, so you don't choose a method. See Add Member Login with the Astro Integration in Go Headless. With another framework, you set up authentication as in self-managed projects.
• Self-managed headless projects: Configure OAuth for visitor and member authentication. For admin operations, use the OAuth client_credentials flow with a client secret, or an API key.
• Wix-managed apps: Host auth in frontend extensions; Wix issues app-instance tokens for backend code automatically. You don't choose a method. See About Authentication in Build Apps.
• Self-managed apps: Configure OAuth for backend code that calls Wix APIs. See About OAuth in Build Apps.
• Blocks apps: Host auth, applied automatically, the same as sites. You don't choose a method.

See also

• Auth Quick Reference
• REST API Authentication
• Identities