Actually, looks like there’s an officially supported way to recover tokens since v2.1, albeit buried in the docs.
influxd recovery auth list --bolt /var/lib/influxdb2/influxdb.bolt
(or whatever the path to your boltdb file is). Doesn’t appear to work if your instance is running, but that can easily be worked around without stopping the process by copying the file to another location like /tmp and reading it there.
You can also use this recovery mechanism to create a new operator (root) token if you’ve somehow managed to accidentally delete the original.