"user:one-time-login-url" token not getting replaced by token_replace I'm trying to send e-mails to users manually by using the hook_mail_alter hook. The following is my function in its entirety:

function custom_module_mail_alter(&amp;$message) {
    $email = '[user:name],

A site administrator at [site:name] has created an account for you. You may now log in by clicking this link or copying and pasting it to your browser:

[user:one-time-login-url]

This link can only be used once to log in and will lead you to a page where you can set your password.

After setting your password, you will be able to log in at [site:login-url] in the future using:

username: [user:name]
password: Your password

--  [site:name] team';

    $account = $message['params']['account'];
    $uid = $account-&gt;uid;

    $_user = user_load($uid);

    dpm(token_replace($email, array('user'=&gt;$_user)));
}


The output looks like this:

Peter,

A site administrator at Website has created an account for you. You may now log in by clicking this link or copying and pasting it to your browser:

[user:one-time-login-url]

This link can only be used once to log in and will lead you to a page where you can set your password.

After setting your password, you will be able to log in at http://localhost/website/user in the future using:

username: Peter
password: Your password

--  Website team


As you can see, things like [user:name], [site:name], and [site:login-url] are properly processed. The only token that isn't processed is [user:one-time-login-url]. Any ideas why this is happening?

EDIT: Just for reference, the token does get processed in the Welcome e-mails that's sent out by the system automatically, so the token module is active and working... It just doesn't seem to get processed when I manually call token_replace().
To replace that token, you need to call token_replace() as token_replace($email, array('user' =&gt; $_user), array('callback' =&gt; 'user_mail_tokens', 'sanitize' =&gt; FALSE)).

The function user_mail_tokens() is described in the documentation as:


  Token callback to add unsafe tokens for user mails.
  
  This function is used by the token_replace() call at the end of _user_mail_text() to set up some additional tokens that can be used in email messages generated by user_mail().


The code used by _user_mail_text() to call that callback is the following one.

// We do not sanitize the token replacement, since the output of this
// replacement is intended for an e-mail message, not a web browser.
return token_replace($text, $variables, array('language' =&gt; $language, 'callback' =&gt; 'user_mail_tokens', 'sanitize' =&gt; FALSE));


The Token module is not necessary to replace tokens, in Drupal 7. The code to replace tokens is part of the Drupal 7 core code; the Token module in Drupal 7 defines extra tokens that Drupal core modules don't define.