Token codes should be valid for 20-30 minutes after generation. There has to be a window in case the clocks are slightly out of sync, due to the battery fading.