Issue a managed student token

POST

/api/v1/orgs/{id}/members/{principal}/tokens

Owned by the member, managed by the org: the member sees it read-only and can't change or revoke it. Never orgs:manage. The secret (hwf_…) is returned this once.

Classroom integration: Issues a fine-grained token owned by the student and managed by the class. Only student-tier members can hold classroom managed tokens; teachers, co-teachers and billing are not eligible holders. Expiry is 1–30 days and the secret appears only in this response. Permission levels cannot include orgs:manage. Choose specific documents where possible. This route has no Idempotency-Key support; do not blindly retry an uncertain issuance.

Required standing: tokens.manage: teacher or billing; orgs:manage and plan managedTokens feature.

Request

Authorization

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

OAuth 2.0

Authorization Code

Add the parameter

Authorization

to Headers，whose value is to concatenate the Token after the Bearer.

Example:

Authorization: Bearer ********************

Authorize URL: https://handwrites.io/oauth/authorize

Token URL: https://handwrites.io/api/oauth/token

Refresh URL: https://handwrites.io/api/oauth/token

Scopes:

orgs:manage-Create, rename and delete teams and classrooms, manage members and invitations, join and leave

Path Params

Body Params application/jsonRequired

Examples

Responses

🟢201

application/json

The token and its secret.

Headers

Bodyapplication/json

🟠400BadRequest

🟠401Unauthorized

🟠403Forbidden

🟠404NotFound

🟠422Unprocessable

🟠429TooManyRequests

🔴500ServerError

Request Example

Shell

JavaScript

Java

Swift

curl --location '/api/v1/orgs//members//tokens' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "name": "string",
    "permissions": {
        "property1": "string",
        "property2": "string"
    },
    "documents": "all",
    "expiresInDays": 1
}'

Response Example

201 - Example 1

{
    "token": {
        "property1": "string",
        "property2": "string"
    },
    "secret": "string"
}

Modified at 2026-10-26 13:12:44

List tokens issued to a member

Revoke a managed token