Use a token for an authenticated integration
An API token lets an external service authenticate on behalf of your account. It is different from a webhook URL token and Auth Secret: a webhook receives incoming lead submissions, while the authenticated API provides application and custom-field endpoints under account access rules.
Open your profile and choose API Tokens. Your token belongs to you, so its access is still subject to your account and company permissions. A token is not a way to bypass a missing carrier relationship or permission.

Create and copy a token
- Choose Create in API Tokens.
- Enter a useful Token name identifying the integration.
- Select the Abilities offered in your account’s token form. Choose only the access the integration needs.
- Set Token expiry if the form offers an expiry date for your workflow.
- Create the token and copy the full value immediately.
- Store it in the external service’s private credential settings, then select I have copied my token when finished.
- Test a read request for a record you already expect this account to access before enabling an automated workflow.
Token fields and lifecycle controls
| Field or button | What it does |
|---|---|
| Token name | A label that helps you identify why a credential exists. |
| Abilities | The capabilities offered by the token form. These do not override the user’s underlying company access rules. |
| Token expiry | When the credential should stop being usable, if configured. |
| Created / Expires / Abilities in the list | Help you review existing credentials; the list does not reveal the original full secret. |
| Edit / Update | Edits the token settings offered by the form. It does not reveal the original secret. |
| Delete | Revokes the selected token. The integration using it must be updated to a replacement token if it should continue working. |
Start with read-only requests
The authenticated application endpoints include GET /api/v1/apps and GET /api/v1/apps/{application}. The application value in the second path is the application identifier provided by the API.
Custom-field integrations can read the company definitions with GET /api/v1/companies/{company}/custom-fields and read an application’s field values with GET /api/v1/apps/{application}/custom-fields. Use the host for your actual Truckers Data account; do not use addresses pictured in the demo screenshots.
Your developer should send the token using an Authorization: Bearer header and request JSON responses. Verify that the returned applications and company are the ones the account is permitted to use.
Understand custom-field identifiers before updating
The custom-field read response includes the definition’s identifier, stable key, label, type, options, required flag, formatted value, and raw value. Use the definition/key supplied for the receiving company rather than assuming another company uses the same identifier.
The custom-field update endpoint accepts a fields object keyed by field key, or a list using a definition identifier/key with a value. Unknown definitions are reported as a validation error. Changes do not alter the public application’s questions.
API and token troubleshooting
| Field or button | What it does |
|---|---|
| 401 / unauthenticated | Check that the token was copied completely, has not expired or been deleted, and is being sent as an Authorization header. |
| 403 / forbidden | Check the user’s company and role, and the relationship to the target company. Issuing another token does not grant a missing relationship. |
| 404 / record not found | Check the identifier and the account’s application scope; a record may not be visible to that account. |
| 422 / validation error | Read the response details and compare field keys, definitions, and the request body. |
| External service stopped after token deletion | Create an appropriate replacement token and update that service’s private credential configuration. |
| Need to send new leads from a form | Use the dedicated inbound webhook workflow and its mapping guide rather than treating a generic application update request as a public-form submission. |