Skip to main content
API tokens are keys that external systems - your website, an integration, or a script - use to read and write your organization’s data through the public API, without anyone sharing an admin login. Each token carries its own set of scopes and its own optional expiry, so you can grant exactly the access an integration needs and revoke it independently. Owners and admins create and manage tokens, and hand them to whoever runs the integration.

​
When to use it

Create a token whenever software, rather than a person, needs your data. Give each integration its own token with only the scopes it needs and an expiry that matches how long it should live, so one leaked or retired key never exposes more than it has to. Typical uses:
  • A website showing your timetable - a padel gym’s marketing site reads Classes, Clubs, and Areas with a read-only token that can never change anything.
  • Piloting a booking integration - a climbing gym gives a third-party kiosk read and write access to bookings on a one-month token, then extends or reissues it once the pilot is stable.
  • A one-off export - a yoga studio pulls a year of transactions for reconciliation with a read-only token that expires after a day.
See Worked examples for the exact scopes and expiry behind each of these.
Programmatic API access is a paid feature. On a free or trial plan you can view, edit, and revoke existing tokens, but the Create Token and Add endpoint buttons are disabled until you upgrade. A banner at the top of the page explains this when it applies.

​
Access and permissions

  • Viewing the token list requires the settings.read.organization permission.
  • Creating, editing, and revoking tokens requires settings.manage.organization.
In practice, only admins (and owners) hold organization settings management, so managers and other roles cannot create or view API tokens. See Roles and permissions.

​
Creating a token

API tokens live on Settings > Organization > APIs & webhooks. The API tokens list shows each token’s Name, Key, Scopes, Expires, Last Used, and Created date.
  1. Click Create Token in the API tokens section.
  2. Fill in the token details:
    • Name - A label that identifies where this token is used, for example “Website class feed”.
    • Description - An optional note on what the token is for.
    • Expires - Pick an expiry from the dropdown, or leave it as No expiry for a token you manage manually.
    • Manages its own bookings - Turn on for a partner platform that runs its own bookings and collects its own payments. Bookings this token creates can then only be changed by the connected system: your staff and members cannot edit or cancel them in 1Club. The token list marks these tokens with a Manages own bookings chip.
    • Scopes - Turn on Full access for an all-access token (see below), or use the resource table: open the Permissions dropdown next to each resource and select the actions you want to allow. A resource you leave on No access stays closed. You must select at least one scope.
  3. Click Save.
  4. Copy the token immediately from the API token created banner with Copy Token. The raw token is shown only once and is never displayed again after you dismiss the banner. Store it in your integration’s secret store.
The Key column shows only a short prefix of each token for identification, never the full value.

​
Token scopes

Scopes use the format resource:action. Each token is a set of these strings. The resource table in the dialog offers the resources and actions that are currently available: The Transactions scope covers the records the admin calls Charges. Transactions: Write records revenue collected outside 1Club, such as a marketplace payout, and refunds of it; it never charges anyone.
  • Read allows fetching data (GET requests).
  • Write allows creating and updating data where that resource exposes those operations.
  • Delete and Publish are separate actions on the resources that offer them, so you can grant writes without deletes, or edit a website without publishing it.
Each action has its own color in the interface (write, delete, and publish stand out from read) so you can spot powerful grants at a glance. Grant only the scopes an integration needs, and avoid write access unless the external system genuinely has to create or change data. The available resources and actions can grow over time; the dialog always reflects the current list.
The Full access switch at the top of Scopes grants every current and future capability (the wildcard scope). The dialog warns that such a token can read and write everything in the organization. Treat it as an all-access key: use it only for a fully trusted, internally managed integration, and prefer explicit resource:action scopes everywhere else. The wildcard is an API-key feature only - an MCP client that asks for it over OAuth is rejected and must name the scopes it wants. See the MCP tools reference.

​
Token expiry

Tokens with no expiry stay active until you revoke them. The list shows the time remaining for tokens that will expire, and Expired once they lapse.

​
Editing a token

Open a token’s actions menu and choose edit to change its name, description, Manages its own bookings setting, scopes, or expiry. Editing does not reveal the raw token again. For a token that already has an expiry, Expires starts on Keep current expiry, so other edits leave the expiry alone. Choosing a duration sets a fresh countdown from now, and choosing No expiry clears it.

​
Revoking a token

  1. Find the token in the list.
  2. Open its actions menu and choose Revoke Token.
  3. Confirm.
Revoking is immediate and permanent. Any integration using that token stops working at once. Create a new token if the integration needs to continue.

​
Webhooks and MCP

  • Webhooks remain on this page, in the Webhooks section. Click Add endpoint and enter an HTTPS Endpoint URL, an optional Description, and the Events to receive. 1Club sends signed POST requests when availability changes. Copy the Signing secret when it is shown, because it is shown only once. The endpoint’s edit dialog has an Enabled switch to pause delivery and Rotate signing secret, which stops the old secret at once. See the Webhooks reference.
  • MCP is separate from API tokens. Open Settings > Artificial Intelligence > AI assistants (MCP) to copy the endpoint, review connected assistants, and revoke OAuth grants. See Connect an assistant.

​
Worked examples

​
Website pulling the class schedule for a padel gym

Your marketing site shows the upcoming padel timetable. Create a token named “Website schedule”, grant Classes: Read, Clubs: Read, and Areas: Read, and leave everything else off. The site can render the schedule but can never modify anything. Give it No expiry and rotate it if the site is rebuilt.

​
A booking integration for a climbing gym

A third-party kiosk needs to read availability and create bookings. Create a token named “Kiosk bookings”, grant Bookings: Read and Bookings: Write, plus Areas: Read and Clubs: Read for context. Set a 1 month expiry while you pilot the integration, then extend or reissue once it is stable.

​
A short-lived data export script

You need to pull transactions once for a year-end reconciliation at a yoga studio. Create a token named “Year-end export”, grant Transactions: Read, set the expiry to 1 day, run the script, and let the token lapse on its own.

​
Tips and best practices

  • Name tokens descriptively so you always know what each one powers.
  • Use the minimum scopes an integration needs, and avoid write access when read is enough.
  • Prefer explicit scopes over the wildcard unless the integration is fully trusted and internally managed.
  • Set an expiry for scripts and pilots so forgotten tokens cannot linger.
  • Watch the last-used date to spot tokens that are no longer active and revoke them.
  • Store tokens in a secret manager - never commit them to source code, paste them into emails, or share them in chat.
  • Revoke and reissue on any suspicion of exposure; there is no way to reveal an existing token again.

​
Troubleshooting

Issue: The Create Token button is disabled. Solution: API access is a paid feature. Free and trial plans can view, edit, and revoke tokens but not create them. Upgrade the plan, then create the token. Issue: I closed the dialog and lost the token value. Solution: The raw token is shown only once. Revoke the token and create a new one, and copy it before dismissing the banner this time. Issue: An integration suddenly returns authorization errors. Solution: Check whether the token expired (the list shows Expired) or was revoked. Also confirm the token has the scopes the request needs - a read-only token cannot create or update data. Reissue with the correct scopes if needed. Issue: A manager cannot see the API tokens page. Solution: Viewing tokens requires organization settings access, which only admins hold. Ask an admin to create or manage the token. Issue: My integration gets 403s on writes even with a token. Solution: The token needs a write scope for that resource (for example Bookings: Write). Edit the token and add the write action, or reissue it with the right scopes.