I think you understand what I said but I don't understand your summary:
"so, every time we make a call to QB, FIRST set the DBVar and THEN check the token with the call."
You seem to be using "we" as representing the external server.
The context above seems to be reversed from what I said. To be explicit: Script in a QuickBase code page makes a request to the external server for a token and caches the token in a user defined variable which formulas URLs can then use to make subsequent resource requests to the external for the period of time the token is valid.