The APIKey token refreshes each time the user authenticates.

Thanks @xie1989 for very helpful crypto advice. Now the default behavior of the APIKey is to generate a new, unique token after each time the user successfully authenticates.