hook_tokens_alter() not applying to [user:one-time-login-url] Token
You cannot alter it because that token is not returned from user_tokens(). You get that token only with code similar to the following one.

$text_with_tokens_replaced = token_replace($text, $variables, array('language' =&gt; $language, 'callback' =&gt; 'user_mail_tokens', 'sanitize' =&gt; FALSE, 'clear' =&gt; TRUE));


The problem is that first the implementations of hook_tokens_alter() are called, then the callback passed to token_replace() is called. The effect is that every value you set for that token is then changed from the callback.

This is the code used from token_replace().

  $replacements = array();
  foreach ($text_tokens as $type =&gt; $tokens) {
    $replacements += token_generate($type, $tokens, $data, $options);
    if (!empty($options['clear'])) {
      $replacements += array_fill_keys($tokens, '');
    }
  }

  // Optionally alter the list of replacement values.
  if (!empty($options['callback']) &amp;&amp; function_exists($options['callback'])) {
    $function = $options['callback'];
    $function($replacements, $data, $options);
  }


token_generate() is the function invoking the token hooks (including the alter hooks).

  $replacements = module_invoke_all('tokens', $type, $tokens, $data, $options);

  // Allow other modules to alter the replacements.
  $context = array(
    'type' =&gt; $type,
    'tokens' =&gt; $tokens,
    'data' =&gt; $data,
    'options' =&gt; $options,
  );
  drupal_alter('tokens', $replacements, $context);