Craft routing with extra attributes
Craft actually has its own built-in support for tokenized requests, which is activated if there's a "token" param. if that param is set, Craft will refer to the craft_tokens table for instructions in how to route the request, ignoring the normal routing steps.

The name of that param can be customized using the tokenParam config setting, but you should probably just have PayPal use a different query string param if you can.