Wix Headless
WixOfficialPublished by Wix
- Skill
- Tool integration
- Software development
- MIT
- Low risk
- Has scripts
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The wix-headless skill acts as an orchestrator for integrating Wix business services (such as Stores, Bookings, and CMS) into a headless frontend architecture. It handles the end-to-end configuration of the Wix backend, including app installation, content seeding, and the generation of a tailored SDK integration guide. Depending on the project type (managed, self-managed, or stripe), the skill can either provide a comprehensive integration guide for the user to implement or, in managed scenarios, actively scaffold, wire, and deploy the frontend project.
What it does
- Infers required Wix capabilities based on user intent and project context.
- Installs necessary Wix apps and seeds backend content automatically.
- Generates a custom SDK integration guide for calling Wix services from the frontend.
- Scaffolds or connects existing frontend projects to Wix for managed hosting.
- Handles project-type-specific authentication and deployment workflows.
- Provides a mechanism to relay feedback to Wix regarding the headless experience.
When to use it
- When you need to integrate Wix business services into a custom-built headless frontend.
- When you want to automate the setup and content seeding of a Wix backend.
- When you are building a new site on Wix infrastructure and need a scaffolded frontend.
- When you have an existing frontend design and need to wire it to Wix business capabilities.
- When working with Stripe Projects and requiring a Wix backend configuration.
Advantages
- Reduces manual configuration by automating app installation and content seeding.
- Provides a clear, actionable SDK integration guide tailored to your specific capabilities.
- Supports multiple project architectures including managed, self-managed, and Stripe-based setups.
- Ensures consistent backend setup by following verified inline recipes.
- Simplifies the transition from design to a functional, Wix-powered headless site.
Usage examples
- “Set up a Wix Headless backend for a store with products and a blog.”
- The skill will install the Stores and Blog apps, seed sample products and posts, and provide an SDK guide for fetching this data in your frontend.
- “I have an existing design; connect it to Wix and host it on their managed infrastructure.”
- The skill will initialize the project, wire the existing UI to the necessary Wix business services, and prepare it for release on Wix.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/wix/wix-headless/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip wix-headless.zip -d .agents/skills
Documentation by Wix
Wix Headless
This skill connects Wix business services to a Wix Headless frontend. Its core job is to configure the Wix backend: infer the needed capabilities, install the Wix apps, seed the backend content, and produce an SDK-integration guide describing how to call Wix from the frontend.
What happens with the frontend depends on the project type and operation:
Backend-only (self-managed, stripe, or a managed "just set up the backend" run) — the skill emits the SDK guide as its final output; the host owns the frontend, build, and hosting.
Managed create / connect — the skill also owns the frontend: it scaffolds a new project (create) or attaches Wix to an existing one (connect), wires it to the backend using that same guide, builds, and releases to Wix. (There is no Designer or template library — the frontend is built ad-hoc to intent.)
On a backend-only run the skill does not own the project scaffolding. When the work needs a frontend, scaffold it according to user intent — framework and structure follow the prompt; the skill's job is the Wix backend plus the emitted SDK guide describing how to call Wix from whatever frontend exists, not choosing or generating the app. This is the norm for a stripe run: the project is provisioned via Stripe Projects (credentials land in
.env— seestripe/AUTHENTICATION.md), the skill configures the backend and emits the guide, and the live site is finalized perstripe/DEPLOYMENT.md— while the frontend is scaffolded and wired to intent, by the host.
Project types
The skill behaves identically across project types except for authentication and deployment, which are isolated in a per-type folder under references/:
| Project type | Hosting | Authentication & deployment live in |
|---|---|---|
managed | Wix infrastructure (maintained by Wix) | references/managed/ |
self-managed | the user's own host (TBD) | references/self-managed/ |
stripe | the user's own host, provisioned via Stripe Projects | references/stripe/ |
Everything else — Discovery, Setup, Seed, the SDK handoff — is project-type-agnostic and refers to "the provided authentication mechanism" rather than any specific method.
Resolving the project type
Resolve the type before Discovery, in this order — stop at the first that decides:
Caller-provided. If the host/caller passed a project type (
managed|self-managed|stripe), use it. An explicit value always wins.Detect from project signals (on disk). Check the working directory (read-only):
stripe—.envcarriesWIX_WIX_CLIENT_ID/WIX_WIX_CLIENT_SECRET/WIX_WIX_METASITE_ID(or the plainWIX_*fallback). This is the Stripe-Projects fingerprint.managed— a Wix CLI project:wix.config.jsonpresent, or a.wix/directory, or@wix/cli/@wix/astroinpackage.json.self-managed— a frontend project on disk (e.g.package.jsonwith a bundler/framework) with neither the Stripe.envfingerprint nor the Wix-CLI markers above.
Detect from user intent. If disk is inconclusive, read the prompt:
managed— "managed", "host on Wix", "Wix-hosted", "deploy to Wix", "wix release".stripe— "stripe projects", "I added Wix via Stripe", a Stripe-Projects context.self-managed— "self-hosted", "my own host", names a non-Wix host, "I'll deploy it myself".
Ask. If signals are absent or conflict, ask the user which type applies — don't guess.
Hold the resolved type in scratch; it selects <TYPE_DIR> (see Path resolution). Note self-managed is TBD — once resolved to it, the auth step will stop with a clear "not wired yet" error.
Resolving the operation (managed only)
create/connect/iterate are managed-only. For managed, resolve the operation by intent first, directory second — never let an empty directory override what the user is asking for. Check iterate first (it's decided by an unambiguous on-disk signal):
iterate→references/managed/CONNECT.md. The project is already connected to Wix — awix.config.json(or.wix/) is already present — and the owner wants to add or change capabilities. Same flow asconnect, but §1 skipsinitand reuses the existingwix.config.json; never re-initan already-connected project.connect→references/managed/CONNECT.md. The user brings a design not yet connected to Wix and wants it wired: a frontend project on disk without awix.config.json, or a brought-in/fetched design (a.zip/folder/file you unzip or read, a design-file URL, a Claude-Design/v0/Lovable export), or language like "connect this / implement this design (… connecting to Wix) / host this on Wix / deploy this to Wix / add Wix Headless to this project". A brought-in or fetched design isconnecteven when the current directory is empty — the design arrives from elsewhere (zip/fetch/URL), so emptiness at trigger time is not a create signal. (CONNECT.mdstep 1 places the brought design into CWD, theninits it.)create→references/managed/CREATE.md. The user wants a new site built from a prompt with nothing brought in — "build me a site / store / blog…", no design file, no project on disk.backend-only— the user only wants the backend configured (no frontend work). → the shared spine + emit the SDK handoff.
For self-managed and stripe, the operation is always backend-only (the host owns the frontend). Only when there is genuinely no brought-in design and no connect language does directory emptiness decide: empty → create; an existing frontend on disk → connect.
Preconditions (the host provides these — we read, never create)
The project type —
managed|self-managed|stripe— provided by the caller, else detected from project signals / user intent (see Project types § "Resolving the project type"), else asked. It selects<TYPE_DIR>(see Path resolution).A Wix metasite + a headless OAuth app exist, and credentials are available — obtained via the project type's
AUTHENTICATION.md. The skill needs a bearer token authorized for the metasite and the metasite id.The user intent — free text describing what Wix should power ("add a store", "blog + contact form", "persist my app's data").
(Optional) the project on disk — read-only, to sharpen brand/capability inference.
If the credentials are absent, the Wix backend isn't reachable — stop with a clear error.
What this skill does
Always open DISCOVERY.md first (it's agnostic — capability/brand/intent inference + the imagery gate, no auth). Then route by project type + operation:
Backend-only (self-managed, stripe, or managed backend-only) — the lean spine:
Discovery (
references/DISCOVERY.md) — infer capabilities + brand + intent + imagery.Setup (
references/SETUP.md) — install the Wix apps those capabilities need.Seed (
references/SEED.md) — create the backend content (+ entity images if imagery is on).Handoff (
references/SDK_HANDOFF.md) — after Setup and Seed, emit the integration guide: SDK bootstrap, per-capability call shapes, the seeded IDs, and the@wix/*package list.Finalize deployment (
<TYPE_DIR>/DEPLOYMENT.md) — run the project-type's finalize steps.
Throughout any run — if the user asks to send feedback to Wix, complains/gets frustrated, or the
run hits any real friction (a confusing error, a doc gap, a tooling dead end, a workaround you had to
invent — it doesn't need to repeat), offer to relay it to Wix per references/FEEDBACK.md. Default
to offering rather than waiting to be asked. Every flow's finalize step (<TYPE_DIR>/DEPLOYMENT.md /
managed/CREATE.md / managed/CONNECT.md) ends with the same checkpoint — treat it as a required
self-check, not optional. Send only after an explicit yes — never automatically.
Managed create / connect / iterate — after Discovery, hand the whole run to the managed flow:
create →
references/managed/CREATE.md(scaffold → Setup → Seed → build the frontend → release).connect →
references/managed/CONNECT.md(init → Setup → Seed → wire the existing UI → release).iterate →
references/managed/CONNECT.md— the project is already connected, so it reuses the existingwix.config.json(noinit). Setup / Seed / wiring are incremental: it may already be set up and seeded from a prior run, so the agent checks current state first (installed apps, already-seeded content, existing wiring) and applies only the delta the new intent needs — never blindly re-installing or re-seeding. Re-release only if the frontend build output changed. These reuse the sameSETUP.md/SEED.md/SDK_HANDOFF.md, but apply the SDK guide to build/wire the frontend themselves rather than emitting it, and release viamanaged/DEPLOYMENT.md.
Each Wix call uses the universal call shape (SETUP.md §1) with $TOKEN/$SITE_ID obtained per <TYPE_DIR>/AUTHENTICATION.md. The skill runs non-interactively except for the one imagery question (and asking the project type if it can't be resolved).
Don't smoke-test the frontend locally unless the user asks to verify. The deliverable is the built-and-released site (managed) or the SDK guide (backend-only) — not a local test report. By default do not start a dev server (
wix dev/astro dev/npm run dev) to curl pages, drive the cart / booking / login flow, or launch a headless browser: correctness comes from following the recipes, real errors surface atwix build/wix release, and a headless run can't complete an interactive login or a real payment anyway — so these loops routinely burn minutes of wall for little signal (this is distinct from, and in addition to, the "release once at the very end" rule — that one only bans extra build+release cycles, not dev-server testing). Only spin up a dev server and smoke-test when the user's prompt explicitly asks to verify / test / confirm it works — and then keep it to a single lightweight pass (pages compile and render), not a full purchase/booking/login drive. The one post-release check in<TYPE_DIR>/DEPLOYMENT.mdis the sanctioned verification.
Donations exception to the smoke-test policy above: for a build that accepts donations, follow
the bounded anonymous API handoff check in references/inline-recipes/how-to-code-donations.md
before claiming it works. It does not authorize a payment or campaign mutation, and does not require
a dev-server testing loop. That recipe also defines the separate hosted-checkout and payment checks.
Path resolution
Compute <SKILL_ROOT> from this file (<SKILL_ROOT>/SKILL.md — strip /SKILL.md); hold the absolute path in scratch. Then resolve the project type to its folder and hold it too:
<TYPE_DIR>=<SKILL_ROOT>/references/<projectType>/— one ofmanaged/,self-managed/,stripe/.
| What | Path |
|---|---|
| Vertical index (intent matching + per-vertical site spec) | <SKILL_ROOT>/references/CAPABILITIES.md |
| Discovery (infer capabilities + brand + intent; existing site → the Dynamic Context call in §1) | <SKILL_ROOT>/references/DISCOVERY.md |
| Setup (install apps) | <SKILL_ROOT>/references/SETUP.md |
| Seed (create backend content) | <SKILL_ROOT>/references/SEED.md |
| SDK-integration handoff (emitted, or applied by create/connect) | <SKILL_ROOT>/references/SDK_HANDOFF.md |
| Image generation (opt-in; agnostic) | <SKILL_ROOT>/references/IMAGE_GENERATION.md |
| Design — fallback visual quality bar for the built frontend, when the user gave no design direction of their own (managed create only) | <SKILL_ROOT>/references/DESIGN.md |
| Content — fallback copy quality bar for the built frontend, when the user gave no copy/voice direction of their own (managed create only) | <SKILL_ROOT>/references/CONTENT.md |
| Experience overlays — a vertical's own design + copy bar on top of DESIGN/CONTENT (optional per vertical; read when that vertical is loaded) | <SKILL_ROOT>/references/inline-recipes/experience-<vertical>.md (today: experience-store.md, experience-donations.md) |
| AI features — text/chat + embeddings (opt-in; agnostic) | <SKILL_ROOT>/references/AI_FEATURES.md |
| Feedback — relay the user's headless-experience feedback to Wix (opt-in; user-approved) | <SKILL_ROOT>/references/FEEDBACK.md |
Authentication — obtain $TOKEN/$SITE_ID/clientId (project-type-specific) | <TYPE_DIR>/AUTHENTICATION.md |
| Deployment — finalize the live site (project-type-specific) | <TYPE_DIR>/DEPLOYMENT.md |
| Managed create flow (scaffold a new project) | <SKILL_ROOT>/references/managed/CREATE.md |
| Managed connect flow (wire an existing project) | <SKILL_ROOT>/references/managed/CONNECT.md |
| Frontend-axis references (how a frontend wires to Wix) | <SKILL_ROOT>/references/astro.md, non-astro.md |
Start a run by opening DISCOVERY.md. The flow files (CAPABILITIES, DISCOVERY, SETUP, SEED, SDK_HANDOFF, IMAGE_GENERATION, AI_FEATURES) are project-type-agnostic; the per-type specifics live under <TYPE_DIR>/ (AUTHENTICATION.md, DEPLOYMENT.md, and — managed only — CREATE.md/CONNECT.md).
Where the how comes from
This skill has no skill upstream — the how is read from the live Wix docs at dev.wix.com/docs. Read-priority: a page this skill links is read by curl-ing its .md twin directly (first priority — don't re-discover a curated link with search); the Wix MCP doc/search tools are second priority, for finding pages the skill doesn't link or as a fallback if a fetch fails. (Append .md to any docs URL for raw markdown; menu pages list child links, content pages carry the schema.)
Doc discovery is the shared fallback for both tracks — never the first move. Each track's primary source is its pinned material (below); when that doesn't cover what you need, fall back to references/DOC_DISCOVERY.md — a semantic doc-search + schema lookup that works with or without the Wix MCP.
Seed reads each capability's create flow from its inline recipe — a self-contained local
inline-recipes/setup-*.md(mapped per capability inSEED.md§ "What to seed per capability") that inlines the calls and supersedes the REST doc pages, so read it and seed from it alone. Only a capability with no inline recipe (e.g.coupons) falls back to doc discovery (DOC_DISCOVERY.md).Handoff links the SDK docs for each capability's API shape, and supplies the runtime package set from the inlined map in
SDK_HANDOFF.md(the SDK.mdpages don't expose@wix/*import strings to navigation, so packages are mapped, not navigated).
Setup carries its app-install call (and the appDefId constants) inline in SETUP.md; CAPABILITIES.md is the vertical index that lets Discovery match intent and declares, per built vertical, the Required site features + Implementation checklist that Seed enables (backend-backed features) and the Handoff carries into the guide (so the host builds a complete site, not a bare data dump). This skill carries the what (which capabilities, how much content, what a finished site includes) and reads the how off the docs.
Files
- ATTRIBUTION.mdAdded by AutoGineer811 B
- LICENSELicence file added by AutoGineer1.0 KiB
- SKILL.md16.0 KiB
- references/AI_FEATURES.md10.3 KiB
- references/CAPABILITIES.md20.6 KiB
- references/CONTENT.md3.8 KiB
- references/DESIGN.md5.3 KiB
- references/DISCOVERY.md8.2 KiB
- references/DOC_DISCOVERY.md2.5 KiB
- references/FEEDBACK.md8.0 KiB
- references/IMAGE_GENERATION.md7.3 KiB
- references/SDK_HANDOFF.md22.5 KiB
- references/SEED.md21.6 KiB
- references/SETUP.md5.1 KiB
- references/astro.md17.3 KiB
- references/inline-recipes/experience-donations.md8.0 KiB
- references/inline-recipes/experience-store.md8.2 KiB
- references/inline-recipes/how-to-code-a-blog.md18.8 KiB
- references/inline-recipes/how-to-code-a-store.md52.6 KiB
- references/inline-recipes/how-to-code-bookings.md28.2 KiB
- references/inline-recipes/how-to-code-cms.md15.3 KiB
- references/inline-recipes/how-to-code-donations.md10.9 KiB
- references/inline-recipes/how-to-code-events.md21.4 KiB
- references/inline-recipes/how-to-code-forms.md43.7 KiB
- references/inline-recipes/how-to-code-members-astro.md11.7 KiB
- references/inline-recipes/how-to-code-members-custom-login.md15.0 KiB
- references/inline-recipes/how-to-code-members-non-astro.md12.4 KiB
- references/inline-recipes/how-to-code-portfolio.md11.7 KiB
- references/inline-recipes/how-to-code-pricing-plans.md18.3 KiB
- references/inline-recipes/how-to-code-rentals.md19.6 KiB
- references/inline-recipes/how-to-code-restaurant-orders.md16.8 KiB
- references/inline-recipes/how-to-code-restaurant-reservations.md19.0 KiB
- references/inline-recipes/how-to-code-restaurants.md11.9 KiB
- references/inline-recipes/setup-blog.md14.2 KiB
- references/inline-recipes/setup-bookings.md19.8 KiB
- references/inline-recipes/setup-cms.md20.5 KiB
- references/inline-recipes/setup-donations.md981 B
- references/inline-recipes/setup-events.md14.1 KiB
- references/inline-recipes/setup-forms.md18.7 KiB
- references/inline-recipes/setup-online-store.md17.0 KiB
- references/inline-recipes/setup-portfolio.md13.2 KiB
- references/inline-recipes/setup-pricing-plans.md17.1 KiB
- references/inline-recipes/setup-rentals.md24.6 KiB
- references/inline-recipes/setup-restaurant-experiences.md7.6 KiB
- references/inline-recipes/setup-restaurant-orders.md19.7 KiB
- references/inline-recipes/setup-restaurant-reservations.md11.6 KiB
- references/inline-recipes/setup-restaurants.md12.7 KiB
- references/managed/AUTHENTICATION.md4.2 KiB
- references/managed/CONNECT.md5.6 KiB
- references/managed/CREATE.md9.9 KiB
- references/managed/DEPLOYMENT.md8.5 KiB
- references/non-astro.md10.4 KiB
- references/self-managed/AUTHENTICATION.md1.2 KiB
- references/self-managed/DEPLOYMENT.md1.1 KiB
- references/stripe/AUTHENTICATION.md4.2 KiB
- references/stripe/DEPLOYMENT.md5.3 KiB
- scripts/bootstrap.mjsScript6.2 KiB
references/non-astro.md
Non-Astro — the pinned docs to read before wiring a non-Astro frontend to Wix
This is the framework reference for any non-Astro frontend — React/Vue/Svelte/Vite SPA or plain static HTML. Astro stays the default (astro.md); read this when the user names a framework or brings a non-Astro design. Like astro.md, it's an index of doc pages with one-line "what it settles" notes, then a Caveats section. It carries no design, templates, payloads, or per-framework code — the model designs and writes the whole frontend; this file says only how it connects.
This file is framework-axis only — it is mode-agnostic. It is read in both the managed and self-managed flows, so it contains no managed-vs-self-managed branching: no init vs OAuth-app, no wix release vs external host, no outputDirectory, no wix.config.json. Anything that differs by who hosts lives in the project-type files (managed/, self-managed/) — you're already reading those in a known mode. Here is only what's identical across both flows: a non-Astro frontend talks to Wix through a manual OAuthStrategy visitor client + the SDK, the same way no matter who hosts it.
The auth rule (the cross-skill boundary). Astro = auto-auth, no client. Non-Astro = manual client. Unlike Astro, you create a client — createClient({ modules, auth: OAuthStrategy({ clientId }) }). For non-Astro this is the documented, correct model (the "Create a Client with OAuth" doc scopes itself to "frameworks other than Astro"). The clientId is the project's public OAuth client id — not a secret. Where that id comes from is your flow's AUTHENTICATION.md (managed: the appId in wix.config.json; self-managed: the OAuth app you created) — this file just uses it.
Two sub-shapes, split on build — a framework fact, not a hosting fact: bundler SPA (has a build step → npm install + import) vs static HTML (no build → load the SDK from a CDN). The caveats below split on that.
How to use it. Before authenticating or wiring data, read the pinned pages top-to-bottom — read-then-act, never invent a URL or a body from memory.
URL form & how to read it. Each link is the .md twin of a docs article. A page pinned here is already curated — read it directly; don't re-discover it with search. The two read paths take different URL forms — don't mix them:
curlthe link — first priority. Fetch it as-is (keep the.md) for raw markdown.MCP doc tools — second priority (discovery of a page this file doesn't pin, or a fallback if a fetch fails). Pass the URL without the
.mdsuffix —ReadFullDocsArticlefor the article pages here,SearchWixSDKDocumentationto reach SDK methods this file doesn't pin.No MCP, or a shape not pinned anywhere → doc discovery (
DOC_DISCOVERY.md): acurlsemantic search (document_type: SDK/WIX_HEADLESS) plus structured schema lookup, then read the hit's.md?apiView=SDK.
1 — Authenticate (the heart — manual client, identical in both flows)
| Page | What it settles |
|---|---|
| https://dev.wix.com/docs/go-headless/self-managed-headless/authentication/oauth/create-a-client-for-authentication-with-oauth.md | The model. Install @wix/sdk + the domain packages, then createClient({ modules, auth: OAuthStrategy({ clientId }) }). clientId only, no secret in the frontend. Explicitly scoped to "frameworks other than Astro." Create the client once and reuse it. |
| https://dev.wix.com/docs/sdk/core-modules/sdk/oauth-strategy.md | OAuthStrategy reference — visitor sessions (automatic) vs member flows (managed/custom/external); token + session methods; confirms clientId only. |
| https://dev.wix.com/docs/go-headless/self-managed-headless/authentication/visitors/handle-visitors-using-the-js-sdk.md | Visitors & members via the JS SDK — visitor token sessions out of the box, and member login when the site needs it. Members are first-class on the non-Astro path (not deferred). |
| https://dev.wix.com/docs/go-headless/authentication/members/wix-login-page/add-a-wix-login-page-js-sdk.md | Member login (Wix login page) — the manual OAuthStrategy handshake: generateOAuthData → getAuthUrl → parseFromUrl → getMemberTokens → setTokens, logout, loggedIn(). Login is sign-up (the Wix page logs in or registers); member tokens are the same shape as visitor tokens (role: member), so they reuse the visitor session machinery — login just swaps the token set. clientId only (no secret); the connected site must be PUBLISHED and the redirectUri must be an exact-match allow-listed URI, or getAuthUrl fails; default to the Wix login page over custom/external. Full frontend contract → Read inline-recipes/how-to-code-members-non-astro.md (local — Read it, don't curl). Only if the brief explicitly asks for a custom/branded login form or custom sign-up fields → Read inline-recipes/how-to-code-members-custom-login.md instead (client.auth.register/login; works on any project type — pick by intent, not project type). |
| https://dev.wix.com/docs/sdk/articles/set-up-a-client/about-the-wix-client.md | Confirms non-Astro does need a client — the "when you need a client vs not" list; non-Astro (managed or self-managed) is on the "needs a client" side, the mirror of Astro. |
clientId source is deferred. This file uses the
clientId; it does not say where it comes from. That's{managed,self-managed}/AUTHENTICATION.md— managed readsappIdfromwix.config.json; self-managed uses the OAuth app you created. Don't re-mint or re-fetch it if the flow already provides it.
2 — Frontend data access (identical in both flows)
All reads and writes go through the client from §1 — the SDK call shapes are framework-identical (the model adapts the idiom: React effect / Vue onMounted / Svelte store). For which packages a capability needs and the SDK module docs for each call shape, use SDK_HANDOFF.md §3 (the package map) — don't restate it here. For what was seeded and the IDs to bind, cross-link SEED.md; the frontend reads it with the visitor client.
| Page | What it settles |
|---|---|
| https://dev.wix.com/docs/sdk/articles/work-with-the-sdk/install-sdk-packages.md | Installing @wix/sdk + domain packages and their current versions (bundler path). |
3 — Build the frontend (framework fact, not hosting)
Bundler SPA — produce the build output with the project's own
npm run build.Static HTML — there is no build; the HTML is the deployable artifact.
This file stops at "produce the build output." Where that output is deployed and how — outputDirectory, publish, origin registration, the index.html-at-root rule — is host-specific and lives in {managed,self-managed}/DEPLOYMENT.md, not here.
4 — Caveats (framework-invariant only)
These hold regardless of who hosts. Host-specific gotchas (static outputDirectory, the index.html rename) are filed in managed/DEPLOYMENT.md, where you're in a known mode. (Numbering: N2/N3 were retired; the gap is intentional and the remaining IDs are kept stable so inbound references don't shift.)
| Caveat | What it says |
|---|---|
| N1 — No Wix scaffolder for a new non-Astro site | There is no Wix command to scaffold a fresh React/Vue/static site — the non-Astro flow is connect-only. To create from scratch, the model runs the framework's own npm create … (e.g. npm create vite@latest), then the flow connects it. Never infer a framework the user didn't name. |
| N4 — No-bundler sites load the SDK from a CDN | With no bundler (static HTML), import the SDK in a <script type="module"> from https://esm.sh/@wix/sdk@1 (plus the domain packages the same way) — there's no npm install step to bundle it. With a bundler, use normal npm install + import. |
| N5 — Client-only ⇒ no elevation ⇒ public-read | A pure SPA/static frontend runs with a visitor token and no server, so there is no auth.elevate. CMS collections it reads must be public-read; anything member-scoped needs member auth. True regardless of who hosts. (Contrast Astro, which can elevate in a backend /api endpoint.) |
N6 — clientId is public; inline it | The OAuth clientId is public, not a secret — it's fine to inline it directly in client code/bundle; there's no runtime secret to protect and no env-var indirection required. (Where the value comes from is still the flow's AUTHENTICATION.md.) |
N7 — Resolve wix:image:// URIs with the SDK, never by hand | SDK media fields (product/blog/CMS images) come back as internal identifiers like wix:image://v1/<hash>/<file>#originWidth=…, not ready URLs. Convert them with the SDK media module — import { media } from '@wix/sdk', then media.getScaledToFillImageUrl(uri, w, h, {}) (returns the URL string directly — do NOT append .url; the 4th options arg is required, pass {}), or media.getImageUrl(uri).url for the original (that one returns a { url } object). The two shapes differ — mixing them (getScaledToFillImageUrl(...).url) resolves every image to undefined. Hand-building a static.wixstatic.com/.../v1/fit/... URL gets the format wrong and the image 403s (or silently fails to load). Only wix:image:// values need this — an already-absolute https:// URL (e.g. an Unsplash placeholder) passes straight through. Docs: https://dev.wix.com/docs/sdk/core-modules/sdk/media. |
N8 — Member login is a manual OAuthStrategy round-trip on the same client | Login (which is sign-up), logout and "am I a member?" run on the visitor client from §1 — don't build a second client. Drive the handshake yourself: generateOAuthData → getAuthUrl → parseFromUrl → getMemberTokens → setTokens, logout, loggedIn(); persist and renew member tokens exactly like visitor tokens (renewToken, re-hydrate with setTokens on boot). Preconditions that bite: clientId only, site PUBLISHED, redirectUri allow-listed exact-match, default to the Wix login page. Read the current member with @wix/members getCurrentMember (not the dev-preview @wix/site-members). No auth.elevate — a member reads their own data under the member token, and a serverless SPA has no elevation anyway (N5). Full contract: inline-recipes/how-to-code-members-non-astro.md. |
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs Node.js
Security
What our scanner noticed· Low risk
- Scripts that your agent may run
This skill includes scripts that your agent may run. Read them before you use it.
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- Wix
- Publisher
- Wix (Official)
- Source
- wix/skills · skills/wix-headless · commit d168bc2
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Wix or Wix.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download wix-headless.zip