Using the app token as a variable works fine.
Thanks for the replies. App is not open to anyone on the internet.
My understanding is that from a security perspective, if you use a variable, it still seems the same, as if the actual app token was entered directly into each button formula, and the app tokens themselves cannot be hidden (
https://community.quickbase.com/quickbase/topics/hide-apptoken-on-formula-rich-text-button-using-a-a... ).
I was thinking this could be an easy way for an admin user, to change the app token, on all buttons if required, rather than having to go through each button.