The token is used in a url in an email. It is "stored" in the user's inbox.