No special magic; they're just random octet strings of appropriate length.  If it's possible for a token to be generated by one server and consumed for another, you'll have to make sure they have the same key.