Subchapter 10.103

Manage OAuth Apps

references/sites/manage-oauth-apps.mdMarkdown5 KBView on GitHub

An OAuth app is a site-level credential holder. Its id is the client_id (the two terms are interchangeable — Wix uses appId in provisioning responses, clientId in token requests, and id in the OAuth Apps API; they all refer to the same value).

When a headless site is provisioned it gets one OAuth app automatically (see Create Headless Site); use this recipe to create additional apps, inspect existing ones, or update their redirect configuration.

client_id is not a secret — it is a public identifier safe to embed in frontend code. The visitor token it mints is also non-privileged: it represents an anonymous visitor, not an admin. The client_secret is different — shown once in the Headless Settings dashboard, never returned by the API, and rotation is dashboard-only.

Manage OAuth Apps · Wix Manage · wix/skills · Skills Docs

curl -X POST \
  'https://www.wixapis.com/oauth-app/v1/oauth-apps' \
  -H 'Authorization: <AUTH>' \
  -H 'wix-site-id: <metaSiteId>' \
  -H 'Content-Type: application/json' \
  -d '{
    "oAuthApp": {
      "name": "My Storefront",
      "loginUrl": "https://example.com/login",
      "allowedRedirectUris": ["https://example.com/callback"],
      "allowedRedirectDomains": ["example.com"]
    }
  }'

{
  "oAuthApp": {
    "id": "<clientId>",
    "name": "My Storefront",
    "loginUrl": "https://example.com/login",
    "allowedRedirectUris": ["https://example.com/callback"],
    "allowedRedirectDomains": ["example.com"],
    "createdDate": "2026-08-18T10:00:00Z"
  }
}

curl -X POST \
  'https://www.wixapis.com/oauth-app/v1/oauth-apps/query' \
  -H 'Authorization: <AUTH>' \
  -H 'wix-site-id: <metaSiteId>' \
  -H 'Content-Type: application/json' \
  -d '{ "query": {} }'

curl -X PATCH \
  'https://www.wixapis.com/oauth-app/v1/oauth-apps/<clientId>' \
  -H 'Authorization: <AUTH>' \
  -H 'wix-site-id: <metaSiteId>' \
  -H 'Content-Type: application/json' \
  -d '{
    "oAuthApp": {
      "allowedRedirectUris": ["https://example.com/callback", "https://example.com/auth"]
    },
    "mask": { "paths": ["allowedRedirectUris"] }
  }'

Field	Notes
`id`	The OAuth `client_id`. Read-only.
`name`	Required on create. 2–256 chars.
`loginUrl`	External login redirect. Defaults to Wix login if omitted.
`logoutUrl`	Called when the user logs out at Wix.
`allowedRedirectUris`	Exact-match URIs for post-authentication redirect. Max 20.
`allowedRedirectDomains`	Domain-level allow-list for non-auth redirects (e.g. checkout). Max 20.
`applicationType`	`WEB_APP`, `MOBILE`, `OTHER`

# Initial anonymous mint
curl -X POST 'https://www.wixapis.com/oauth2/token' \
  -H 'Content-Type: application/json' \
  -d '{ "clientId": "<clientId>", "grantType": "anonymous" }'

# Response: { "access_token": "...", "refresh_token": "...", "expires_in": 14400 }

# Refresh (use this instead of re-minting)
curl -X POST 'https://www.wixapis.com/oauth2/token' \
  -H 'Content-Type: application/json' \
  -d '{ "clientId": "<clientId>", "grantType": "refresh_token", "refreshToken": "<refreshToken>" }'

Manage OAuth Apps

Manage OAuth Apps

Get an OAuth App

Query OAuth Apps

Update an OAuth App

Key Fields

Minting a Visitor Token

API Reference