What is the best way to get salesforce security token of a API Only user?

From Salesfoce Security token and the API (my emphasis):

Users can obtain their security token by changing their password or resetting their security token via the Salesforce user interface. When a user changes their password or resets their security token, Salesforce sends a new security token to the email address on the user’s Salesforce record. The security token is valid until a user resets their security token, changes their password, or has their password reset. In the UI - change API only user profile to another non-api only user profile. Log in, reset security token. The IP range(s) on the profile assigned to the non-API User must allow your IP or you will not see the 'Reset Security Token' option on the User record.