I wouldn't have any clue if this is correct but I know it works if you just 1. Get the csrf token from (still possible while logged out) 2. Log in using the csrf token (only time when email and password get involved) 3. Continue using the csrf token for whatever else
1. Get the csrf token from (still possible while logged out)
2. Log in using the csrf token (only time when email and password get involved)
3. Continue using the csrf token for whatever else
get your token by logging in: POST uses form url encoded for input in token key
put your token in the authorization header as a bearer