A token is the list. Anyone with the link can read and write it, so treat the link as the password. A token you make up yourself is a room name, not a secret.