Every third-party application that works with your fleet — an analytics tool, a logbook, an ERP connector, a script you wrote yourself — asks for a Wialon API token. It is worth understanding what you are handing over before you paste one into a form, because a token is an access grant with a scope and a lifetime, and both are yours to set.
What a token actually is
A token authenticates an application, not a person. It carries three things: whose account it acts on, what it is allowed to do there, and until when. That is the whole point — you can give a reporting tool permission to read units and messages, let it expire in a year, and revoke it in ten seconds without touching your own password or disturbing anyone else’s access.
Two practical consequences follow. First, an application that only reads should never be given rights that let it edit, because a token cannot exceed the access rights of the user who issued it but it can easily be given more than it needs. Second, one token per application: shared tokens cannot be revoked individually, so the day you drop one tool you end up breaking three.
The fast way: an authorization link
Most applications hand you a link that does the work. It opens Wialon’s own login page, shows you what the application is asking for, and returns a token when you click Allow. FleetTAB’s looks like this:
https://hosting.wialon.com/login.html?client_id=fleettab&access_type=-1&activation_time=0&duration=0&lang=en&flags=0x1Read the parameters, because they are the grant:
client_id— the application being authorized, as Wialon will list it afterwards.access_type— the access level, as a sum of flags (see below).-1is unlimited.duration— the lifetime in seconds.0means no expiry date.activation_time— when the token becomes valid;0is immediately.
You log in with your normal Wialon credentials on Wialon’s own domain — the application never sees them — and the token comes back in the redirect URL as access_token. It is a 72-character string. Paste it into the application and you are connected.
If you use a hosting other than hosting.wialon.com, swap the host for your own. The parameters are identical.
Choosing an access level
The access_type value is a sum of flags, each unlocking a category of operations:
| Value | What it grants |
|---|---|
| 256 | Online tracking |
| 512 | Viewing data |
| 1024 | Editing non-sensitive data |
| 2048 | Editing sensitive data |
| 4096 | Editing critical data, deleting messages |
| 8192 | Sending commands, editing tasks |
| 16384 | Managing activation codes |
| -1 | Unlimited access |
Add the ones you need: 256 + 512 = 768 is the read-only combination most analytics tools should be given. A tool that writes back — a logbook that saves trip statuses, a maintenance app that records a completed service — needs 1024 on top, and sometimes 2048.
The safe default is the smallest sum that makes the application work. If you are not sure what a tool needs, ask its vendor which operations it calls; a straight answer is a good sign.
Where your tokens live
Issued tokens are listed in the Wialon monitoring interface under the user menu, in Manage applications → Authorized applications. Each entry shows what it is, when it was activated, when it expires and what it can do. This is the page to check when you inherit an account: tokens issued by a previous administrator keep working until somebody looks.
Two lifetime rules are worth remembering. A token created without a duration has no expiry date, but Wialon deletes any token that has not been used for 100 days — even an unlimited one. And a token can be edited: you can narrow its rights or shorten its expiry after the fact, without reissuing it.
Revoking access
Delete the token in that same list. Access stops immediately, and the application is locked out until someone issues a new one. Nothing else about the account changes — other tokens, other users and your own login are untouched. That is the reason to insist on token-based integrations in the first place: revocation is a decision you can make on a Friday afternoon without consequences for anyone else.
In FleetTAB you can also remove the stored token from the Settings page, which drops the connection from our side. The token itself remains valid in Wialon until you delete it there, so do both if you are ending the relationship.
When the token does not work
The failures are almost always one of four, and Wialon names them in its error codes:
- 8 — invalid username or password. You are on the login step, not the token step.
- 1 — invalid session. The token is fine; the session built from it expired and the application needs to log in again.
- 7 — access denied. The token is real but its access level does not cover the operation. Reissue it with the right flags.
- 1011 — your IP has changed, or the session has expired. Common on mobile networks and VPNs, and normal for an application to recover from by re-authenticating.
The full list is in Wialon API error codes, in plain English, which is worth a read before you conclude that an integration is broken.
What FleetTAB does with it
One token is the entire setup. FleetTAB reads your Wialon account over the API and writes back only what you edit inside FleetTAB itself: trip statuses, driver assignments, service records. Nothing is migrated, Wialon stays the source of truth, and the token is stored encrypted and tied to your FleetTAB account rather than to a device, so you paste it once.
If you want to see exactly which screens that unlocks before issuing anything, the features page walks through them, and the setup documentation covers the connection step in detail.
