You can exempt the CsrfToken follow this things.

authentication.py

from rest_framework.authentication import SessionAuthentication

class CsrfExemptSessionAuthentication(SessionAuthentication):

    def enforce_csrf(self, request):
        return True

Add this file in the settings.py

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.TokenAuthentication',
        'xxxxxx.authentication.CsrfExemptSessionAuthentication',
 )}