as to why rclone must save the token to the config file i do not know.
seems that if the config file is read-only, rclone should save the token to ram.
not sure if this helps:
i use service files, so in my config there are no tokens.
no worries, as we have many rclone experts, who should stop by soon.
https://github.com/rclone/rclone/issues/3655
Failed to save config file - #10 by jchwenger
Rclone config dir owned by root