Many projects need to store sensitive values like API keys, OAuth tokens, and environment configuration. Hardcoding those values into the codebase is a security risk, especially when code is shared or stored in a public repository. The Wix Secrets Manager provides a secure place to store these values so backend code can look them up by name at runtime instead of embedding them in the code itself.
Key properties of the Secrets Manager:
- Backend-only: Lives in the dashboard and is accessible only to a project's backend code through the Wix Secrets API. Frontend code can't reach it directly.
- Secret structure: Each secret has a unique name, a value, and an optional description. Wix stores the value in encrypted form, not as plain text.
- Collaborator access: Only collaborators with the Admin (Co-Owner) or Website Manager roles can view or manage secrets in the dashboard.
Secrets follow the site through ownership changes, but not through copies:
- Site transfer: When a site is transferred to a new owner, its secrets transfer with it and the new owner can read and manage them.
- Site duplication: When a site is duplicated, secrets stay with the original. The duplicate site starts with an empty Secrets Manager, so any backend code that depends on a named secret needs that secret added to the duplicate before it can run.
The development path determines how you use the Secrets Manager:
- Sites: Access secrets from backend code through the Secrets API. Create and manage them in the Secrets Manager in the site dashboard.
- Wix-managed headless projects: Access secrets from backend code through the Secrets API on the underlying Wix project.
- Self-managed headless projects: Access secrets from backend code through the Secrets API on the underlying Wix project, or manage secrets in your own infrastructure instead of the Wix Secrets Manager.
- Wix-managed apps: Access secrets on the host site through the Secrets API from backend code when the app is installed.
- Self-managed apps: Access secrets on the host site through the Secrets API from backend code when the app is installed.
- Blocks apps: Access secrets on the host site through the Secrets API from backend code when the app is installed.