How do OTP tokens work?

If this is off-topic here, please direct me to the 'right' group.

I just got a VeriSign Secure Key from PayPal, which is a one time
password (TP) token used for two factor authentication (TFA). The
PayPal Secure Key is a sequence-based token. Here's how I think it
works:

Although it displays six digits, I don't think it generates six digit
pseudo-random numbers. Rather, I think the six digits are made-up of
two components. The first component is the next number in the pseudo-
random sequence and the other is an encoding of the number of button
presses there have been.

Given the server 'knows' where in the pseudo-random sequence the key
began and how many key-presses (sequences) there have been, it 'knows'
where the key is in the sequence.

Does anyone know if I'm right about this?

There are also time-based TP tokens. My nephew uses one at his work
place and I can't figure out how they are kept synchronized with the
login server.

If I suppose time-based tokens had perfect clocks; then given the
server knows both where (in the pseudo-random sequence) and precisely
when (in real time) the device was started; it would always 'know'
exactly where the token is in the sequence. Simple.

But the clocks _can't_ be that precise. I will assume a drift of a
few seconds in three years and that would produce unacceptable login
failure rates.

Does anyone know how time-based tokens work?

Thanks for the explanation, Nick. Since my previous post, it dawned
on me that the TP server could choose a 'medium' in the PSR sequence,
allowing for an TP either side of the medium and giving it the
ability
to make necessary timing adjustments.

But I didn't suppose they would give it as much latitude as you
pointed
out. Now I realize why this is necessary. , tokens not used
for long periods of time would become useless.