I'm a newbie and an idiot to boot. I've a question in relation to tokenizing: is there a methodology out there that would allow you reidentify without using a token to value lookup? I'd have thought no but have a developer claiming something different. I contend that what he's talking about is an encryption process.
You could use for example an asymmetric keys pair, where the private key is stored on the user's device, and where the public key is saved in the server side.
At sign-in, the server send a challenge request (random bytes + current timestamp), the client need to sign the challenge and the server can verify the signature.