I understand that token authentication doesnt really have the concept of logging out— that a token merely identifies a user.
Is there any way to invalidate all tokens? Maybe via the change of some variable from which all the tokens are generated— causing everyone to need to log in again?
I guess it depends a bit on which auth system you are using. In case you are using rest_framework.authtoken, you could simply clear the Token table:
from rest_framework.authtoken.models import Token
Token.objects.all().delete();
No token, not logged in ;)