Question on Tokenization and the need to maintain a value to token lookup
You could use for example an asymmetric keys pair, where the private key is stored on the user's device, and where the public key is saved in the server side. 

At sign-in, the server send a challenge request (random bytes + current timestamp), the client need to sign the challenge and the server can verify the signature.