Issue a managed fine-grained token (admins, billing)

POST

/api/v1/orgs/{id}/members/{principal}/tokens

Owned by the member, managed by the org: the member sees it read-only and can't change or revoke it. Never orgs:manage. The secret (hwf_…) is returned this once.

Team authority: Owner/admin or billing (tokens.manage), plan with managedTokens, target must be member tier.

App integration: Creates a member-owned fine-grained credential valid for 1–30 days. It acts as the member, not the team. It cannot contain orgs:manage. Store the one-time secret securely and deliver it only through your authorised flow; do not put it in logs or ordinary messages.

Request

Authorization

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

OAuth 2.0

Authorization Code

Add the parameter

Authorization

to Headers，whose value is to concatenate the Token after the Bearer.

Example:

Authorization: Bearer ********************

Authorize URL: https://handwrites.io/oauth/authorize

Token URL: https://handwrites.io/api/oauth/token

Refresh URL: https://handwrites.io/api/oauth/token

Scopes:

orgs:manage-Create, rename and delete teams and classrooms, manage members and invitations, join and leave

Path Params

Body Params application/jsonRequired

Examples

Responses

🟢201

application/json

The token and its secret.

Headers

Bodyapplication/json

🟠400BadRequest

🟠401Unauthorized

🟠403Forbidden

🟠404NotFound

🟠422Unprocessable

🟠429TooManyRequests

🔴500ServerError

Request Example

Shell

JavaScript

Java

Swift

curl --location '/api/v1/orgs//members//tokens' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "name": "string",
    "permissions": {
        "property1": "string",
        "property2": "string"
    },
    "documents": "all",
    "expiresInDays": 1
}'

Response Example

201 - Example 1

{
    "token": {
        "property1": "string",
        "property2": "string"
    },
    "secret": "string"
}

Modified at 2026-10-26 13:12:30

Managed tokens issued to a member (tokens.read)

Revoke a managed token (admins, billing)