Wialon API Token
A Wialon API token is the only method FleetTAB uses to connect to Wialon. You generate the token once in your Wialon account, paste it into FleetTAB, and the connection is maintained automatically from that point on.
What is a Wialon API Token?
A Wialon API token is a 72-character alphanumeric string that grants FleetTAB permission to read data from your Wialon account — trips, units, sensors, driver assignments, and analytics — without requiring your Wialon username or password to be stored anywhere.
Token length is exactly 72 characters. FleetTAB validates length on entry and will reject tokens that are too short or too long.
How to Generate a Token
Wialon provides a dedicated token generation URL. The process takes about one minute.
-
Open the following URL in your browser, replacing the host if you use a self-hosted Wialon instance:
https://hosting.wialon.com/login.html?client_id=fleettab&access_type=-1&activation_time=0&duration=0&lang=en&flags=0x1 -
Log into your Wialon account if prompted.
-
Review the permissions requested and click Allow (or your Wialon version's equivalent confirmation button).
-
After authorizing, you will be redirected to a URL that contains the token. Look for the
access_tokenparameter in the address bar. -
Copy the token value — it is exactly 72 characters long.
If your organization uses a self-hosted Wialon instance, replace hosting.wialon.com in the URL above with your instance's hostname. The rest of the URL structure is the same.
Some Wialon deployments label this as a "long-lived token" or "API key." If you cannot locate the token generation flow, ask your Wialon system administrator — they may need to enable API access for your account tier.
Entering the Token in FleetTAB
The first time you log into FleetTAB, a setup modal appears automatically. You cannot access fleet data until the token is entered.
- Log into FleetTAB with your email and verification code.
- When the Wialon connection modal appears, paste your 72-character token into the token field.
- Click Connect. FleetTAB validates the token immediately.
- If the token is valid, the modal closes and your fleet data loads.
If validation fails, verify that you copied the complete token from the address bar, including any characters at the end. A common mistake is accidentally omitting the final few characters.
Secure Storage
FleetTAB encrypts your token using AES-256 before storing it. The encrypted token is associated with your FleetTAB account, not with a specific browser or device.
This means:
- You only need to enter the token once, even if you switch devices or clear your browser data.
- FleetTAB reconnects automatically using the stored token each time you log in.
- No one with access to the storage layer can read the token in plain text.
Your token is sent directly to the Wialon API when making requests. It is never logged or exposed in FleetTAB's application layer.
Auto-Connect on Future Logins
After your token is stored, FleetTAB connects to Wialon automatically every time you log in. You will not see the connection modal again unless:
- Your token is revoked or expires in Wialon.
- You manually remove the token from Settings.
- Your FleetTAB account is reset.
Updating Your Token
If you need to replace your token (for example, after revoking the old one or rotating credentials):
- Go to Settings in the left sidebar.
- Navigate to the Wialon Connection section.
- Click Update Token (or the equivalent control in your version).
- Paste the new token and confirm.
FleetTAB immediately validates and saves the replacement token.
Revoking Access
To remove FleetTAB's access to your Wialon account entirely:
- Open your Wialon account settings and locate the token you generated for FleetTAB.
- Delete or revoke the token. This takes effect immediately — FleetTAB will lose access at that moment.
- Optionally, remove the token from FleetTAB's Settings page as well to keep things tidy.
To reconnect later, generate a new token and enter it in FleetTAB Settings.
If you use the same Wialon token for multiple applications, revoking it will disconnect all of them at once. Generate a separate token per application if you need to manage access independently.