Get my session's CSRF token
Returns the session-bound token for cross-site request forgery protection
(ADR 053 §5). Browser code sends it in the X-Zitadel-CSRF header on the
state-changing requests the session cookie authenticates that require it
— see the sessionCookie scheme. It authorizes nothing on its own: the
HttpOnly cookie is still the credential, and a cross-site page cannot
read this response. It stays the same for the life of the session, so a
client fetches it once per session.
With project_id, the token is returned only when the session belongs to
that project.
sessionCookie__Host-zitadel_session<token>The session cookie issued at session creation or superseding handoff exchange.
A browser holds it as __Host-zitadel_session, with Secure. Over plain
http to a loopback host (localhost, 127.0.0.1, ::1) the server sets it
as zitadel_session instead, without Secure or the prefix, so that Safari
keeps it, and accepts that name there too; __Host-zitadel_session takes
precedence. A program sends __Host-zitadel_session over any transport.
A missing or invalid cookie yields 401 with code auth.unauthorized and the message
Missing or invalid session token.
Cross-site request forgery (ADR 053 §5): a state-changing request that this
cookie authenticates must come from the same origin — a cross-site browser
request is refused with 403 and code auth.csrf_invalid. Every such
request must also send the session's token from GET /sessions/me/csrf in the
X-Zitadel-CSRF header, or it answers the same 403. The only exceptions are
the POST …/query reads, which need no token. Safe methods (GET) are not checked. A request a project secret
authenticates is not affected.
project_id?stringThe project the caller signs its users in to. The cookie's session is used
only when it belongs to this project; a session of any other project answers
403 with sess.project_mismatch.
A session belongs to one project, while a browser sends its cookie to every app on the same host. An app passes its own project, so that a session of another project never reads or acts as one of its users, and signing out of the app never ends it. The SDKs pass it when they read the session or sign out.
sess.project_mismatch does not mean the session is invalid: it is live in
its own project, so keep its cookie.
^[a-zA-Z0-9_-]+$The session's CSRF token.
application/json- response
The session-bound CSRF token (ADR 053 §5).
csrf_token*stringSend it in the X-Zitadel-CSRF header on state-changing requests the
session cookie authenticates.
import { configureZitadel, getApi } from "@zitadel/api/config";// In the browser, through the SDK proxy: the session cookie authenticates the call.const client = getApi(configureZitadel({ projectId: "proj_01KWH1P4MYS7F0N9WD3P2E4YM5" }));const mySessionCsrfToken = await client.getMySessionCsrfToken();{ "csrf_token": "string"}Was this helpful?