---
title: "Get Csrf Token"
method: GET
path: "/auth/csrf-token"
tags: ["auth"]
---

# Get Csrf Token

`GET /auth/csrf-token`

## Request

- Base URL: `https://dev.whispa.net` (the document declares no server; this is the origin it was published from)
- URL: `https://dev.whispa.net/auth/csrf-token`
- Auth: none declared

Get a CSRF token for cookie-authenticated requests.

This endpoint sets a CSRF token in an HttpOnly cookie and returns the
same token in the JSON body. Clients store the body token (e.g., in
memory or localStorage) and send it via the X-CSRF-Token header on all
state-changing requests. The browser sends the cookie automatically;
the server validates header == cookie (double-submit pattern).

Desktop apps using Bearer authentication do not need CSRF tokens.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/whispa/apis/whispa-api.md) - [All operations](https://skmtc.dev/whispa/apis/whispa-api/llms.txt) - [OpenAPI document](https://skmtc.dev/whispa/apis/whispa-api/revisions/12c2e4aca43c?raw)