Consider I'm creating a RESTful API (like Twitter API) and I need only a single key token to access the endpoint `GET /messages`.

* The token needs to be sent via header `access_token` for example.
* If I don't pass the token I'll get an 4xx error.

In the RESTful API scenario, is this all needed to protect against CSRF attacks? I mean, in RESTful APIs I'm not using Cookies to manager a user session, since the idea here is to not be a session (Stateless is one of the principles of REST).

Am I forgetting something or is this correct? I don't see why I would need a `anti CSRF token` besides my access token.

Thanks in advance!