OAuth Provider token generation
Each token must be;
  
  
  non-sequential
  non-guessable
  unique
  


Without reading into any of the OAuth specifics, if the above is the only criteria to which you must adhere, then I would suggest what you're doing is quite a huge effort to achieve what's already been done with GUID (Globally Unique Identifier).

Java has an implementation of this, a class named UUID:


  ...that represents an immutable
  universally unique identifier (UUID).
  A UUID represents a 128-bit value.


Conveniently, a GUID is also a 32 character string.

Some code I found to utilise this using Java:

UUID uuid = UUID.randomUUID();
String randomUUIDString = uuid.toString();


Note that I'm not really qualified to be an authority on this where Java is concerned, though the topic I'm concerning myself with here is very transferable, you will need to determine whether A) a GUID satisfies all criteria of an OAuth token, and B) that the Java implementation works as the rest of the world expects - I can't vouch for that.