Csrf

Package account is your own account: API keys you mint and revoke, and org onboarding.

csrf

GET /v1/csrf

IssueCSRFToken mints the anti-CSRF token a browser echoes as X-CSRF-Token on every money write (mint/revoke a key, top up, onboard, and the billing/commerce write verbs). The token is bound to the caller's validated identity and expires, so one minted for one identity cannot authorize a write as another.

It is answered no-store, so it is never cached by a shared proxy. This is the same-origin endpoint the embedded console reads — the Same-Origin Policy is what stops a cross-site page from reading the response and forging a write.

---

All Hanzo APIs · Interactive reference