Probably a uid rather than a hash. And the token has corresponding metadata like ip, account number, date/time etc.