Skip to main content
API tokens are keys that external systems - your website, an integration, or a script - use to read and write your organization’s data through the public API, without anyone sharing an admin login. Each token carries its own set of scopes and its own optional expiry, so you can grant exactly the access an integration needs and revoke it independently.

​
Overview

From Settings > Organization > APIs & webhooks you can:
  • Create tokens with a name, optional description, scopes, and an optional expiry.
  • Scope each token to specific resources and actions (read, write) so it can only touch what it needs.
  • Edit a token’s name, description, scopes, and expiry after creating it.
  • Revoke a token instantly when it is no longer needed or may be compromised.
  • See at a glance each token’s prefix, scopes, expiry, last-used date, and created date.
The same page also hosts Webhooks. MCP connections now have a separate page under Settings > Artificial Intelligence and use OAuth instead of API tokens.
Programmatic API access is a paid feature. On a free or trial plan you can view and revoke existing tokens, but the Add button is disabled until you upgrade. A banner at the top of the page explains this when it applies.

​
Access and permissions

  • Viewing the token list requires the settings.read.organization permission.
  • Creating, editing, and revoking tokens requires settings.manage.organization.
In practice, only admins (and owners) hold organization settings management, so managers and other roles cannot create or view API tokens. See Roles and permissions.

​
Creating a token

  1. Click Add in the API tokens section.
  2. Fill in the token details:
    • Name - A label that identifies where this token is used, for example “Website class feed”.
    • Description - An optional note on what the token is for.
    • Expires - Pick an expiry from the dropdown, or leave it as No expiry for a token you manage manually.
    • Scopes - In the resource table, open the Permissions dropdown next to each resource and select the actions you want to allow. Leave a resource untouched for no access to it. You must select at least one scope.
  3. Click Save.
  4. Copy the token immediately from the success banner. The raw token is shown only once and is never displayed again after you dismiss the banner. Store it in your integration’s secret store.
The token list shows only a short prefix of each token for identification, never the full value.

​
Token scopes

Scopes use the format resource:action. Each token is a set of these strings. The resource table in the dialog offers the resources and actions that are currently available:
  • Read allows fetching data (GET requests).
  • Write allows creating, updating, and deleting data where that resource exposes those operations.
Write actions are highlighted in the interface so you can spot them at a glance. Grant only the scopes an integration needs, and avoid write access unless the external system genuinely has to create or change data. The available resources and actions can grow over time; the dialog always reflects the current list.
A wildcard scope exists that grants access to all current and future scopes. Treat it as an all-access key: use it only for a fully trusted, internally managed integration, and prefer explicit resource:action scopes everywhere else. The wildcard is an API-key feature only - an MCP client that asks for it over OAuth is rejected and must name the scopes it wants. See the MCP tools reference.

​
Token expiry

Tokens with no expiry stay active until you revoke them. The list shows the time remaining for tokens that will expire, and Expired once they lapse.

​
Editing a token

Open a token’s actions menu and choose edit to change its name, description, scopes, or expiry. Editing does not reveal the raw token again.
Choosing an expiry in the edit dialog sets a fresh countdown from now. If you edit a token without picking an expiry option, its expiry is cleared and it becomes a no-expiry token. Set the expiry deliberately each time you edit.

​
Revoking a token

  1. Find the token in the list.
  2. Open its actions menu and choose Revoke.
  3. Confirm.
Revoking is immediate and permanent. Any integration using that token stops working at once. Create a new token if the integration needs to continue.

​
Webhooks and MCP

  • Webhooks remain on this page. Register endpoint URLs that 1Club calls when availability changes, each with its own signing secret. See the Webhooks reference.
  • MCP is separate from API tokens. Open Settings > Artificial Intelligence > AI assistants (MCP) to copy the endpoint, review connected assistants, and revoke OAuth grants. See Connect an assistant.

​
Worked examples

​
Website pulling the class schedule for a padel club

Your marketing site shows the upcoming padel timetable. Create a token named “Website schedule”, grant Classes: Read, Clubs: Read, and Areas: Read, and leave everything else off. The site can render the schedule but can never modify anything. Give it No expiry and rotate it if the site is rebuilt.

​
A booking integration for a climbing gym

A third-party kiosk needs to read availability and create bookings. Create a token named “Kiosk bookings”, grant Bookings: Read and Bookings: Write, plus Areas: Read and Clubs: Read for context. Set a 1 month expiry while you pilot the integration, then extend or reissue once it is stable.

​
A short-lived data export script

You need to pull transactions once for a year-end reconciliation at a yoga studio. Create a token named “Year-end export”, grant Transactions: Read, set the expiry to 1 day, run the script, and let the token lapse on its own.

​
Tips and best practices

  • Name tokens descriptively so you always know what each one powers.
  • Use the minimum scopes an integration needs, and avoid write access when read is enough.
  • Prefer explicit scopes over the wildcard unless the integration is fully trusted and internally managed.
  • Set an expiry for scripts and pilots so forgotten tokens cannot linger.
  • Watch the last-used date to spot tokens that are no longer active and revoke them.
  • Store tokens in a secret manager - never commit them to source code, paste them into emails, or share them in chat.
  • Revoke and reissue on any suspicion of exposure; there is no way to reveal an existing token again.

​
Troubleshooting

Issue: The Add button is disabled. Solution: API access is a paid feature. Free and trial plans can view and revoke tokens but not create them. Upgrade the plan, then create the token. Issue: I closed the dialog and lost the token value. Solution: The raw token is shown only once. Revoke the token and create a new one, and copy it before dismissing the banner this time. Issue: An integration suddenly returns authorization errors. Solution: Check whether the token expired (the list shows Expired) or was revoked. Also confirm the token has the scopes the request needs - a read-only token cannot create or update data. Reissue with the correct scopes if needed. Issue: A manager cannot see the API tokens page. Solution: Viewing tokens requires organization settings access, which only admins hold. Ask an admin to create or manage the token. Issue: My integration gets 403s on writes even with a token. Solution: The token needs a write scope for that resource (for example Bookings: Write). Edit the token and add the write action, or reissue it with the right scopes.