It looks like the token file is in the format

K[33 random bytes hex-encoded]::server:[16 random bytes hex-encoded]

. The thing I’m not sure of is if the values are related (IE if they’re a public/private keypair or something)

No, you can’t pre-generate a full token. The first bit is the string K10 followed by the sha256 sum of the cluster CA certificate, which isn’t generated until after you start the cluster the first time.

Gotcha ty