What's the best way to reset/roll a user's api token?

If you force a password reset it will invalidate their sessions.

Awesome, thanks