I agree with David's answer, and I would just like to add that without need of an external database, the token you store to prove that a payment was done by a given user, who, in accordance with your processing, has the right to obtain a license for your software is a collection and processing of data allowing you to identify such a user individually.
The same reasoning applies here as with cookies. They allow to single-out a person (or even a group of persons using the same browser in the case of cookies), and that suffices to consider that the information collected and stored is personal information, and that you are using it for your own purposes of checking licensing rights (certainly passing through the API your own details about the purchase order).
The token would absolutely not be anonymous data. If it has to be legally classified, it would be pseudonymous information, which is not anonymous because it allows to single-out a person.
See Article 29 Working Party's opinion 0829/14/EN WP216 on the subject for more details about Anonymisation Techniques and distinctions with pseudonymisation.
When referring to "costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments" in Recital 26 the GDPR is simply covering the case where while an Anonymisation Technique may be considered safe at a certain point in time, as the technology evolves, this may not longer be the case.
It is interesting to note that, at the time WP29 wrote the above mentioned opinion, the draft versions of GDPR were being amended by the European Parliament, and WP29 expressly noted this amendment (at that time contained in a Recital 23), and that after referring to it (footnote 6 in 2.2.2) WP29 subsequently stated that "It should be noted that the identification risk may increase over time and depends also on the development of information and communication technology".
To answer the OP's question, tokenization is expressly referred to by WP29 as being a pseudonymisation technique (Section 4, page 21), and not an anonymisation technique.