Wix restricts sensitive methods based on identity, roles, and permissions to protect site and account data.
Sometimes you need to call a method that requires higher authorization than the identity making the call has. For example, Confirm Booking can't be called by site visitors or members, or by Wix users without an administrative bookings role. Elevation lets you make the call anyway, where supported.
Depending on the development path, you apply elevation either to a single call or to a client used for multiple calls. The rest of your flow that doesn't go through elevation continues to use the caller's identity.
Elevation must run in backend code, to avoid exposing your app's credentials.
Keep elevation scoped to the specific call that needs higher permissions. Don't use elevation if the operation already works with the caller's existing permissions. For backend-only server-to-server admin work, use an API key to authenticate.
Caution: When backend code that elevates is reachable from outside, anyone who can call that code gets elevated access. Make sure callers are properly authorized before the elevation runs.
The development path determines how you elevate calls:
client_credentials flow, which yields an app token that runs as the Wix app identity. For admin access beyond the project's own site, use an API key instead. See About Admin Operations.Last updated: 2 August 2026