diff --git a/templates/settings_token.html b/templates/settings_token.html
new file mode 100644
index 0000000..73467d7
--- /dev/null
+++ b/templates/settings_token.html
@@ -0,0 +1,184 @@
+{% extends 'base.html' %}
+{%block head_title%}Subscriber API Management - {%endblock%}
+{% block body %}
+
+
+
+
+ 電子報系統設定
+
+
+ API Token 設定
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
此 Token 只會顯示一次，關掉此畫面後便無法複製此 Token
+
+ - 標籤：[[ createNewTokenResp.label ]]
+ - Token：[[ createNewTokenResp.token ]]
+
+
+
+
+
+
+
+{% endblock %}
+{% block js %}
+
+
+{% endblock %}
diff --git a/view/token.py b/view/token.py
new file mode 100644
index 0000000..5dc0ecb
--- /dev/null
+++ b/view/token.py
@@ -0,0 +1,88 @@
+''' API token management '''
+from flask import Blueprint, Response, make_response, render_template, request, jsonify
+from werkzeug.exceptions import BadRequest
+
+from module.api_token import APIToken
+
+VIEW_TOKEN = Blueprint('token', __name__, url_prefix='/token')
+
+@VIEW_TOKEN.errorhandler(BadRequest)
+def handle_bad_request(e: BadRequest) -> Response:
+ ''' Handle Bad Request exception '''
+ return make_response({ 'message': e.description }, e.code)
+
+@VIEW_TOKEN.route('/', methods=('GET',))
+def index() -> str:
+ ''' index page '''
+ return render_template('settings_token.html')
+
+@VIEW_TOKEN.route('/', methods=('POST',))
+def create_token() -> str | Response:
+ '''API for creating token
+
+ Request Body:
+ {
+ "label": string
+ }
+
+ Response Body (200):
+ {
+ "label": string,
+ "token": string,
+ }
+ '''
+ create_token_dto = request.get_json()
+
+ if 'label' not in create_token_dto or \
+ not isinstance(create_token_dto['label'], str) or \
+ len(create_token_dto['label']) == 0:
+ raise BadRequest('label should not be empty string.')
+
+ new_token = APIToken.create(create_token_dto['label'])
+ return jsonify({
+ 'label': new_token.label,
+ 'token': new_token.token,
+ })
+
+@VIEW_TOKEN.route('/list', methods=('GET',))
+def get_list() -> Response:
+ ''' API for getting list of tokens
+
+ Response Body (200):
+ {
+ "tokens": [
+ {
+ "serial_no": string,
+ "label": string
+ }
+ ]
+ }
+ '''
+ tokens = APIToken.get_list()
+ return jsonify({ 'tokens': tokens })
+
+@VIEW_TOKEN.route('/', methods=('DELETE',))
+def delete() -> Response:
+ ''' API for deleting token
+ Request Body:
+ {
+ "serial_no": string,
+ }
+
+ Response Body (200):
+ {
+ "success": boolean,
+ }
+ '''
+ delete_token_dto = request.get_json()
+
+ if not isinstance(delete_token_dto['tokens'], list):
+ raise BadRequest('tokens should be in the body and an array of string')
+
+ for token in delete_token_dto['tokens']:
+ if not isinstance(token, str):
+ raise BadRequest('tokens should be an array of string')
+
+ APIToken.delete(delete_token_dto['tokens'])
+
+ return jsonify({ 'success': True })
diff --git a/view/volunteer.py b/view/volunteer.py
new file mode 100644
index 0000000..c2884e5
--- /dev/null
+++ b/view/volunteer.py
@@ -0,0 +1,47 @@
+'''
+API for COSCUP-Volunteer
+'''
+import re
+
+from flask import Blueprint, make_response, Response, request
+from werkzeug.exceptions import BadRequest
+
+from module.subscriber import Subscriber
+
+VIEW_VOLUNTEER = Blueprint('volunteer', __name__, url_prefix='/volunteer')
+
+EMAIL_REGEX = re.compile(r'[^@]+@[^@]+\.[^@]+')
+
+@VIEW_VOLUNTEER.errorhandler(BadRequest)
+def handle_bad_request(e: BadRequest) -> Response:
+ ''' Handle Bad Request exception '''
+ return make_response({ 'message': e.description }, e.code)
+
+@VIEW_VOLUNTEER.route('/subscriber', methods=('POST',))
+def add_subscriber() -> Response:
+ '''API for add subscriber from COSCUP-Volunteer
+
+ Request Body:
+ {
+ "name": string,
+ "email": string
+ }
+ '''
+ add_subscriber_dto = request.get_json()
+ if 'name' not in add_subscriber_dto or \
+ not isinstance(add_subscriber_dto['name'], str):
+ raise BadRequest('name should be in the request body and string')
+
+ if 'email' not in add_subscriber_dto or \
+ not isinstance(add_subscriber_dto['email'], str):
+ raise BadRequest('email should be in the request body and string')
+
+ if not EMAIL_REGEX.match(add_subscriber_dto['email']):
+ raise BadRequest('The email is not valid')
+
+ Subscriber.process_upload(
+ name=add_subscriber_dto['name'],
+ mail=add_subscriber_dto['email']
+ )
+
+ return make_response({ 'success': True })