Give the token a name you'll recognise later and grant only the scopes it needs. Fewer scopes means less damage if it leaks. The secret appears on the next screen — once.
For your reference only. Name it after where it runs, so you can find it later.
At least one scope is required. A token with no scopes can't do anything.
Short-lived tokens are safer. You can always create a new one.
Contract. POST /api/organizations/{orgId}/tokens with
{ name, scopes[], expires_at? } → 201 returning the token metadata
plus the raw secret exactly once (frame c). Scope options should be rendered from the
org's available scope catalogue rather than hard-coded; the four shown are illustrative
Resource:action strings.
Fail-closed. Submit is disabled until a name is present and at least one scope is
checked — a zero-scope token is never created. Scopes are additive grants, never a bypass of
the org's own access rules.