Now make sure that only someone over 18 can generate token, and that token cannot be given to 3rd party for reuse.

The first problem is easy: Write the token on the back of your ID when the government issues it to someone over 18.

The second problem is universally intractable. If you have the cooperation of someone over 18, the service will let you in and has no way of knowing that the person using it is a different person.