Is the AuthToken generator unique enough?

Question

What will happen once I generate say a million AuthTokens for users (on multiple devices).. should I be worried about uniqueness down the line?

The line that generates the token in the API is:

    def generate_key(self):
    unique = uuid.uuid4()
    return hmac.new(unique.bytes, digestmod=sha1).hexdigest()

It seems as though it's SHA1 so I'm assuming it should be OK but perhaps I should validate not only the token but perhaps an incoming device id or e-mail?

Any thoughts?