I have created an SPI to generate action tokens by extendin the AbstractActionTokenHandler class as described in the official documentation. I am also overriding canUseTokenRepeatedly method and returning boolean false so that the token can be used only one time, but I am still able to resuse the token multiple times. I have verified that the canUseTokenRepeatedly method is getting called before handleToken method.