OK, but then the prefetch link as it stands is useless, no?
https://example/com/token?forBots
https://example.com/token
https://example.com/token?forBots
Hopefully any automated systems will open the first or last link first, so that you can save the request info and filter based on that. In case requests come out of order, you can always add a small delay to the "human" link before responding.