Avoid enabling the API Token for user accounts
Use OAuth and user login credentials to generate a token. Once an API Token is created for a user account, which is a legacy API access way, that user will on longer be bale to login to the online client.