May be they generate new tokens for every request and one set of the key is in hardware itself protected.
Such a waste of tech and resources to not let use the very things which they purchased.