Hi,
I suspect that this is happening because in the Security settings you've set to reset the authentication token every few minutes.
Please, check this setting: (tokenduration) in Security -> Site policies
Re your questions:
1. Is generated automatically
2. No, it isn't
Regards, Juan