# Подключение к WB API — токен или OAuth 2.0
- Collection: developer.wildberries.ru
Documentation
Release Notes
Swagger
Sandbox
API Status
Community
Knowledge Base
More
Documentation
Release Notes
Swagger
Sandbox
API Status
Community
Knowledge Base
Sign In
Where to start
What is WB API
Developer portal
Connecting to the API
Connecting a service: a step-by-step path for the seller
Ways to connect to WB API: token and OAuth 2.0
Cloud service or local solution: how to tell them apart and which token to choose
WB API data categories: how to choose the right ones for your integration
How to connect to the API with a token
How to connect to the API via OAuth 2.0
How to create, refresh, or delete a WB API token
Authorization and security
Testing and the sandbox
Working with the API
Monitoring and updates
The WB API platform for services
Training and support
Guides
Case studies
Tool integrations
Cookbook
Home
/
Connecting to the API
/
Ways to connect to WB API: token and OAuth 2.0
Ways to connect to WB API: token and OAuth 2.0
Comparing the two authorization methods and the token types
Publication date: 16.09.2026
Two authorization methods
There are two authorization methods for connecting to WB API. Both give access to the same data and API methods — they differ in how they work, how convenient they are, and the level of security.
Connecting with a token
The seller creates a token themselves in the WB Partners personal account, selects the data categories and the access level, and then passes the token to the system being connected. A token is a string of characters that is added to the header of every request to the API.
How it works:
The seller creates a token in the "API Integrations" section
Selects the token type, the data categories, and the access level
Copies the token and enters it in the service's settings or hands it to a developer
The service or program uses the token to access data
A token is valid for 180 days, after which it must be reissued.
For details, see How to connect to the API with a token
Connecting via OAuth 2.0
OAuth 2.0 is an authorization protocol that lets a service access a seller's data without passing a token manually. The seller simply confirms the connection in the interface — everything else happens automatically.
OAuth 2.0 works both ways: a SaaS service uses it to gain access to the seller's store data, and the seller uses it to connect a service to their store without manually creating and passing tokens.
How it works:
The seller picks a service in the Catalog of Solutions for Business on Wildberries
Clicks "Connect" and confirms which data the service will access
The system automatically grants the service access rights
The service receives the data, and the seller does not need to copy and enter a token
An OAuth connection is valid indefinitely — until the seller or the service disconnects it. Technically, the OAuth 2.0 tokens are refreshed automatically, so the seller does not need to track expiry dates — unlike regular tokens, which are valid for 180 days.
For details, see How to connect to the API via OAuth 2.0
When to use a token
Connecting with a token is a good fit in the following cases:
In-house development. You are connecting your own program, script, or module — OAuth 2.0 is not designed for this.
The service does not support OAuth 2.0. Not every service has implemented support for this protocol.
On-premise (local) solution. The program is installed on your own servers — for example, the boxed version of 1C. A Personal token is used for such cases.
Testing and development. A Test token is used for working in the sandbox.
When to use OAuth 2.0
OAuth 2.0 is the recommended connection method if:
You are connecting a cloud service from the Solutions Catalog that supports OAuth 2.0.
Simplicity matters. There is no need to create, copy, and enter a token — connecting takes a couple of clicks.
Security matters. You can revoke a specific service's access at any time without affecting other integrations. The service receives only the data it needs to operate.
You don't want to track the validity period. An OAuth connection refreshes automatically — there is no need to reissue a token every 180 days.
Comparing the connection methods
WB API token types
When connecting with a token, four types are available, each for its own task:
Personal token — for your own programs and on-premise solutions on your infrastructure. Provides extended capabilities, including user management. Must not be shared with third parties or cloud services.
Service token — for connecting a cloud service from the Solutions Catalog. Bound to a specific service; the settings are filled in automatically.
Base token — for the remaining cases, when neither a Personal nor a Service token fits. Has access to a limited set of data categories. Starting March 30, 2026, reduced request limits apply to Base tokens — for details, see WB API rate limits.
Test token — for development and testing in the sandbox. Has no access to a store's real data.
For details on each type, including step-by-step instructions for creating one, see How to create, refresh, or delete a WB API token
If you are not sure which type to choose, use the article Cloud service or local solution: how to tell them apart and which token to choose
Russia
User Agreement of the WB API Service
WB API Platform Access Agreement
WB API Price List for Third-Party Services
Personal Data Processing Policy
Cookie Policy
Cookie Settings
FAQ. Frequently Asked Questions