/wix-manage

Manage OAuth Apps

An OAuth app is a site-level credential holder. Its id is the client_id (the two terms are interchangeable — Wix uses appId in provisioning responses, clientId in token requests, and id in the OAuth Apps API; they all refer to the same value).

When a headless site is provisioned it gets one OAuth app automatically (see Create Headless Site); use this recipe to create additional apps, inspect existing ones, or update their redirect configuration.

client_id is not a secret — it is a public identifier safe to embed in frontend code. The visitor token it mints is also non-privileged: it represents an anonymous visitor, not an admin. The client_secret is different — shown once in the Headless Settings dashboard, never returned by the API, and rotation is dashboard-only.

Create an OAuth App

Endpoint: POST https://www.wixapis.com/oauth-app/v1/oauth-apps

curl -X POST \
  'https://www.wixapis.com/oauth-app/v1/oauth-apps' \
  -H 'Authorization: <AUTH>' \
  -H 'wix-site-id: <metaSiteId>' \
  -H 'Content-Type: application/json' \
  -d '{
    "oAuthApp": {
      "name": "My Storefront",
      "loginUrl": "https://example.com/login",
      "allowedRedirectUris": ["https://example.com/callback"],
      "allowedRedirectDomains": ["example.com"]
    }
  }'

Response:

{
  "oAuthApp": {
    "id": "<clientId>",
    "name": "My Storefront",
    "loginUrl": "https://example.com/login",
    "allowedRedirectUris": ["https://example.com/callback"],
    "allowedRedirectDomains": ["example.com"],
    "createdDate": "2026-08-18T10:00:00Z"
  }
}

id is the OAuth client_id. After creating the app, retrieve the client_secret from the Headless Settings dashboard.

Get an OAuth App

Endpoint: GET https://www.wixapis.com/oauth-app/v1/oauth-apps/{id}

curl 'https://www.wixapis.com/oauth-app/v1/oauth-apps/<clientId>' \
  -H 'Authorization: <AUTH>' \
  -H 'wix-site-id: <metaSiteId>'

Query OAuth Apps

Endpoint: POST https://www.wixapis.com/oauth-app/v1/oauth-apps/query

curl -X POST \
  'https://www.wixapis.com/oauth-app/v1/oauth-apps/query' \
  -H 'Authorization: <AUTH>' \
  -H 'wix-site-id: <metaSiteId>' \
  -H 'Content-Type: application/json' \
  -d '{ "query": {} }'

Returns all OAuth apps for the site.

Update an OAuth App

Endpoint: PATCH https://www.wixapis.com/oauth-app/v1/oauth-apps/{id}

Update requires an explicit mask.paths — omitting it silently updates nothing.

Updatable fields: name, description, loginUrl, logoutUrl, allowedRedirectUris, allowedRedirectDomains, technology.

curl -X PATCH \
  'https://www.wixapis.com/oauth-app/v1/oauth-apps/<clientId>' \
  -H 'Authorization: <AUTH>' \
  -H 'wix-site-id: <metaSiteId>' \
  -H 'Content-Type: application/json' \
  -d '{
    "oAuthApp": {
      "allowedRedirectUris": ["https://example.com/callback", "https://example.com/auth"]
    },
    "mask": { "paths": ["allowedRedirectUris"] }
  }'

Key Fields

Minting a Visitor Token

Once you have a client_id, frontends use it to mint an anonymous visitor token for buyer-facing API calls.

Endpoint: POST https://www.wixapis.com/oauth2/token

# Initial anonymous mint
curl -X POST 'https://www.wixapis.com/oauth2/token' \
  -H 'Content-Type: application/json' \
  -d '{ "clientId": "<clientId>", "grantType": "anonymous" }'

# Response: { "access_token": "...", "refresh_token": "...", "expires_in": 14400 }

# Refresh (use this instead of re-minting)
curl -X POST 'https://www.wixapis.com/oauth2/token' \
  -H 'Content-Type: application/json' \
  -d '{ "clientId": "<clientId>", "grantType": "refresh_token", "refreshToken": "<refreshToken>" }'

Use the access_token as the Authorization header on subsequent API calls.

Never re-mint anonymous on every load. The visitor token is the cart/session identity — a fresh anonymous mint creates a new visitor and silently empties the cart. Persist the refresh_token and use it to renew.

API Reference

• OAuth Apps — Create
• OAuth Apps — Get
• OAuth Apps — Query
• OAuth Apps — Update
• Retrieve Tokens — /oauth2/token contract, all grant types