Okay, having raised a support ticket they have bounced me back here. After a bit of searching I finally found this bit of “hidden” documentation:
I cannot find any reference to this anywhere in the documentation, which is really not clever. It also looks like the wildcard functionality doesn’t handle url arguments that well either, so you can’t have a script that gets gets the tokens on a “first use” basis if you are passing arguments in the original url.
Incredibly incompetent of the API team not to have properly documented this 18+ months after introduction, IMO.