---
title: "Read the session's CSRF token"
method: GET
path: "/auth/csrf"
tags: ["account"]
---

# Read the session's CSRF token

`GET /auth/csrf`

## Request

- Base URL: `https://account.close.city`
- URL: `https://account.close.city/auth/csrf`
- Auth: API key in cookie `__Host-wtm_session`

Return the CSRF token for the signed-in session. Send it as an X-CSRF-Token header on POST /keys and POST /billing/subscribe.

## Response `200`

The CSRF token.

- object
  - `csrf` string

## Other responses

- `401`: No signed-in session.

---

[API](https://skmtc.dev/close-city/apis/close-api.md) · [All operations](https://skmtc.dev/close-city/apis/close-api/llms.txt) · [OpenAPI document](https://skmtc.dev/close-city/apis/close-api/revisions/a70e7c778d65?raw)