Force expiration of particular token

We’ve had software crawl our site to find SEO issues.

The crawl has found every URL twice, once with a token, once without. Each of the URLs with the token is displaying the same, and with the URL-with-token as canonical, so as far as the crawl is concerned, there are two identical URLs.

It is the same token sequence for each URL.

Is there a way to flush this apparently working token out? Or htaccess to redirect to the token-less URL?