Your event handler becomes impure - re-frame docs describe why that's bad. At the very least, you can move reset! into its own effect. But how storing the token in app-db is less convenient? Your example doesn't really show the issue - :retrieve-messages is only there once, and its handler is broken.

If you store the token in a separate atom, you will still have to get it from that atom - I don't see any significant differences from just using app-db. But if you want to keep your event handlers pure, you will have to use effects and co-effects, which make using an extra atom clunky.

I guess that’s especially true in this example. the actual location of my token is buried under a parent key, but it’s still not much of a difference, but my concern is especially the sanity of my db but i can fix that other ways

(let [token (-> db :auth :token)]
  (api-call token))
vs 
(api-call (:auth-token @app-state))

If you consider something a part of your app's state, then store it in app-db. I cannot really add anything else.