SDK function calls are restricted using identities. An identity defines who is calling a function and what actions they are authorized to take. Each function in the SDK can only be called by specific identities. The identities authorized to call each function are indicated in the function's API reference.
The SDK uses the following identities:
An anonymous site visitor who hasn't logged in. Functions that can be called by this identity usually involve operations specific to a particular visitor. These include accessing a list of products, creating and managing a cart, or accessing a login page to authenticate as a member.
A site member who has logged in. Functions that can be called by this identity usually involve operations specific to a registered member. These include accessing or managing personal data.
A Wix user is someone who is logged into their account on .wix.com. Users can be site owners or site collaborators, as well as app owners and collaborators who create test sites. Users who create a site are automatically designated as the owner of that site.
Functions that can be called by this identity usually involve site maintenance operations. These include managing site products, media, and marketing campaigns.
Site owners can invite collaborators and assign them specific user roles to control permissions. In this case, the SDK functions that the app can access when making calls as a collaborator are limited by the collaborator's user roles.
Learn more about authenticating as a Wix user.
Wix apps are packages of reusable functionality that users can add to their sites. When an app is installed or updated on a Wix site, Wix generates an app instance with a unique ID. This ID represents the installed version of the app on that particular site. An SDK function call authenticated with the Wix app identity is a call made by an app for a specific app instance.
Functions that can be called by this identity usually involve site-level operations. These include managing the site's data collections, contacts, or products.
Each function in the SDK requires certain permissions when called by a Wix App. To check which permissions a function requires, refer to its API reference.
Learn more about configuring app permissions.
An admin with customized administrative access to a Wix account's sites and projects. API keys are created and managed in the API Keys Manager where you can assign a set of permissions that determine the types of APIs each key can access.
Functions that can be called by this identity usually involve administrative operations at the site or account level. These include managing members or business data. API keys can also be used to call many of the same functions a site visitor or site member can call.
In some app extensions, your app's API calls have visitor, member, or Wix user authentication by default. In these cases, you can use the SDK to elevate specific calls to use Wix app authentication.
Learn more about elevated permissions.