I'm still a novice here, so please forgive me if I am off base, but aren't you authorizing the code and getting the token through AJAX? Couldn't you override the save process in the controller, Get the request data, have a function in your model send the code and get the token and update the request data with the token, then proceed with the parent::save(); Name the code field the same as your databases token field and before the data is saved you change it from the code to the token. If that worries you because you might save the code or because it might be populated with the token at a later time, name the code something different and have an empty hidden token field on your form.
That is what I have been doing, though not with any external requests. It's pretty simple though.
I did a little experimenting, and it seemed if the field was not on the form, the data would not save when I updated the request array with a value, so a field seems to be required. In other words, using your case, if I have a code field and no token field; grad the request array and add $data['token'] = xxxx to the array and push it back into the request, it still does not save in the db, but if there is a token field, it works fine.