--- title: "How to Create a Wialon API Token - FleetTAB" url: https://fleettab.app/blog/wialon-api-token/ description: "A Wialon API token is how an app reads your fleet without your password. Here is how to issue one, which access level to give it, and how to revoke it." --- # How to Create a Wialon API Token [Siarhei Havarunou](https://linkedin.com/in/sergey-govorunov) – CEO September 21, 2026 A Wialon API token is how an app reads your fleet without your password. Here is how to issue one, which access level to give it, and how to revoke it. Every third-party application that works with your fleet — an analytics tool, a logbook, an ERP connector, a script you wrote yourself — asks for a **Wialon API token**. It is worth understanding what you are handing over before you paste one into a form, because a token is an access grant with a scope and a lifetime, and both are yours to set. ## What a token actually is A token authenticates an *application*, not a person. It carries three things: whose account it acts on, what it is allowed to do there, and until when. That is the whole point — you can give a reporting tool permission to read units and messages, let it expire in a year, and revoke it in ten seconds without touching your own password or disturbing anyone else’s access. Two practical consequences follow. First, an application that only reads should never be given rights that let it edit, because a token cannot exceed the access rights of the user who issued it but it can easily be given more than it needs. Second, one token per application: shared tokens cannot be revoked individually, so the day you drop one tool you end up breaking three. ## The fast way: an authorization link Most applications hand you a link that does the work. It opens Wialon’s own login page, shows you what the application is asking for, and returns a token when you click **Allow**. FleetTAB’s looks like this: `https://hosting.wialon.com/login.html?client_id=fleettab&access_type=-1&activation_time=0&duration=0&lang=en&flags=0x1` Read the parameters, because they are the grant: - `client_id` — the application being authorized, as Wialon will list it afterwards. - `access_type` — the access level, as a sum of flags (see below). `-1` is unlimited. - `duration` — the lifetime in seconds. `0` means no expiry date. - `activation_time` — when the token becomes valid; `0` is immediately. You log in with your normal Wialon credentials on Wialon’s own domain — the application never sees them — and the token comes back in the redirect URL as `access_token`. It is a 72-character string. Paste it into the application and you are connected. If you use a hosting other than `hosting.wialon.com`, swap the host for your own. The parameters are identical. ## Choosing an access level The `access_type` value is a sum of flags, each unlocking a category of operations: | Value | What it grants | | --- | --- | | 256 | Online tracking | | 512 | Viewing data | | 1024 | Editing non-sensitive data | | 2048 | Editing sensitive data | | 4096 | Editing critical data, deleting messages | | 8192 | Sending commands, editing tasks | | 16384 | Managing activation codes | | -1 | Unlimited access | Add the ones you need: `256 + 512 = 768` is the read-only combination most analytics tools should be given. A tool that writes back — a logbook that saves trip statuses, a maintenance app that records a completed service — needs `1024` on top, and sometimes `2048`. The safe default is the smallest sum that makes the application work. If you are not sure what a tool needs, ask its vendor which operations it calls; a straight answer is a good sign. ## Where your tokens live Issued tokens are listed in the Wialon monitoring interface under the user menu, in **Manage applications → Authorized applications**. Each entry shows what it is, when it was activated, when it expires and what it can do. This is the page to check when you inherit an account: tokens issued by a previous administrator keep working until somebody looks. Two lifetime rules are worth remembering. A token created without a duration has no expiry date, but Wialon deletes any token that has not been used for **100 days** — even an unlimited one. And a token can be edited: you can narrow its rights or shorten its expiry after the fact, without reissuing it. ## Revoking access Delete the token in that same list. Access stops immediately, and the application is locked out until someone issues a new one. Nothing else about the account changes — other tokens, other users and your own login are untouched. That is the reason to insist on token-based integrations in the first place: revocation is a decision you can make on a Friday afternoon without consequences for anyone else. In FleetTAB you can also remove the stored token from the Settings page, which drops the connection from our side. The token itself remains valid in Wialon until you delete it there, so do both if you are ending the relationship. ## When the token does not work The failures are almost always one of four, and Wialon names them in its error codes: - **8 — invalid username or password.** You are on the login step, not the token step. - **1 — invalid session.** The token is fine; the session built from it expired and the application needs to log in again. - **7 — access denied.** The token is real but its access level does not cover the operation. Reissue it with the right flags. - **1011 — your IP has changed, or the session has expired.** Common on mobile networks and VPNs, and normal for an application to recover from by re-authenticating. The full list is in [Wialon API error codes, in plain English](https://fleettab.app/blog/wialon-api-errors/), which is worth a read before you conclude that an integration is broken. ## What FleetTAB does with it One token is the entire setup. [FleetTAB](https://fleettab.app/features/) reads your Wialon account over the API and writes back only what you edit inside FleetTAB itself: trip statuses, driver assignments, service records. Nothing is migrated, Wialon stays the source of truth, and the token is stored encrypted and tied to your FleetTAB account rather than to a device, so you paste it once. If you want to see exactly which screens that unlocks before issuing anything, the [features page](https://fleettab.app/features/) walks through them, and the [setup documentation](https://docs.fleettab.app/wialon/token-auth/) covers the connection step in detail. ## Frequently asked questions ### Is a Wialon API token the same as my password? + No. A password authenticates you; a token authenticates one application, with an access level you choose and an expiry you set. You can revoke a token without changing your password, and an application that only reads data never needs credentials that could change it. ### How long does a Wialon token last? + Whatever you set. Tokens are created for 30 days by default, and a duration of 0 means no expiry date. Wialon still deletes a token that has gone unused for 100 days, even an unlimited one, so a token behind an application you actually use stays alive and a forgotten one cleans itself up. ### What access level does a read-only integration need? + Online tracking (256) plus viewing data (512) — 768 combined — covers reading units, messages and reports. Anything that writes back, such as saving a trip status or a service record, also needs editing rights: 1024 for non-sensitive data, 2048 for sensitive data. ### How do I revoke a Wialon token? + Open the list of authorized applications in the Wialon monitoring interface (user menu, Manage applications, Authorized applications), find the token and delete it. Access stops immediately, and the application is locked out until a new token is issued. ## More from FleetTAB - September 21, 2026 · API ### Wialon API Error Codes, in Plain English What Wialon's API error codes actually mean — 1, 4, 7, 1003 and the rest — which ones are your fault, which are limits, and what to do about each. [Wialon API Error Codes, in Plain English](https://fleettab.app/blog/wialon-api-errors/) - November 6, 2026 · Reports ### Wialon Idling Report: Where Idle Time Comes From How Wialon calculates idling, where it appears in reports and eco-driving, why the totals drift, and how to rank which vehicles idle most. [Wialon Idling Report: Where Idle Time Comes From](https://fleettab.app/blog/wialon-idling-report/) - September 21, 2026 · Eco-driving ### Wialon Eco-Driving: From Criteria to a Usable Score Wialon detects harsh braking, acceleration and speeding. Turning those violations into a driver score people accept takes a few decisions — here they are. [Wialon Eco-Driving: From Criteria to a Usable Score](https://fleettab.app/blog/wialon-eco-driving-score/) Contact us ## Get in touch Questions, a demo, or white-label for your own company — tell us. A person answers, usually the same working day. No newsletter, and nothing is passed on — see the [privacy policy](https://fleettab.app/privacy/). Why FleetTAB Your fleet data is already in Wialon. Put it to work. **Free on your own account** No per-vehicle fee. White-label and custom work are the paid parts. **Nothing migrated** Wialon stays the source of truth, and switching off leaves it untouched. **Minutes, not a project** One Wialon API token, revocable from Wialon at any moment. [Start free on your Wialon](https://app.fleettab.app/login) or write to [support@theassettrack.com](mailto:support@theassettrack.com)