Been killing this day by cracking on various flavours of tokens used in pebble terminology, so while it's all fresh in my head will try to put it here (at least my current understanding of it)

Watch Token - Watch/App specific unique token. Watch/App means it is unique per hardware piece (watch) and software piece (app) - i.e. each app will get own version of the token, but the token will be the same if you install/remove/install app. To put it simple - it's hash of the app UUID and HW Serial.

OAuthToken - this is simple. This is authentication token generated once user logged in. Pebble uses long-living (not expiring) tokens so one may safely stash it and use whenever needed. As an example - Pebble SDK uses it this way. Can be obtained at https://auth.getpebble.com/oauth or https://auth-client.getpebble.com/en_US/ with appropriate pebble:// schema handler (eg. gecko in rockpool)

Account token - this is more tricky and more simple. This is unique user ID. It will be the same whatever number of times you generate new OAuthToken. Really - just pebble account id. Can be obtained from https://auth.getpebble.com/api/v1/me.json with proper OAuthToken.

Timeline Token or User Token - this is a User/App specific unique identifier. It is available via locker API when installed app is registered at the locker (with proper OAuthToken). The token is required to manage Timeline subscriptions. Can be obtained at https://api2.getpebble.com/v2/locker/<AppUUID>

Timeline Token or Sandbox Token - this was the most confusing. It appears to be same as above but for apps which are not yet published to the store, rather just hanging at the dev portal. So the function is the same, usage is the same, principle is the same - just allows one (developer that is) to use timeline without publishing the app to the store (but still publishing at devs.portal). Can be obtained at https://timeline-sync.getpebble.com/v1/tokens/sandbox/<AppUUID>

phew. gone sleeping.