---
title: "Mint a CSRF token for this session"
method: POST
path: "/v1/auth/csrf"
tags: ["auth"]
---

# Mint a CSRF token for this session

`POST /v1/auth/csrf`

## Request

- Base URL: `https://api.hyperresearch.ai`
- URL: `https://api.hyperresearch.ai/v1/auth/csrf`
- Auth: API key in cookie `hr_session`

Rotates and returns the session CSRF token. The token it replaces keeps working for a short grace window, so a second tab mid-submit is not refused (E2E5-01). Cookie-authenticated; requires no CSRF token of its own, since a caller that holds none is exactly the caller this exists for.

## Response `200`

Token minted

- AuthCsrfResult
  - `csrf_token` string, required
  - `session` AuthSessionExpiry, required
    - `expires_at` string, required

## Other responses

- `400`: Invalid request
- `401`: Authentication failed
- `403`: Insufficient scope or plan
- `404`: Not found
- `429`: Rate limited or over quota
- `500`: Internal error

---

[API](https://skmtc.dev/hyperresearch/apis/hyperresearch-cloud-api.md) · [All operations](https://skmtc.dev/hyperresearch/apis/hyperresearch-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hyperresearch/apis/hyperresearch-cloud-api/revisions/726ef831ebf4?raw)