Headless CraftCMS as mobile app backend, requiring login
You could make the CSRF token available via an element API endpoint, then submit the form with that;

'api/csrf-token' =&gt; [
      'elementType' =&gt; GlobalSet::class,
      'paginate' =&gt; false,
      'one' =&gt; true,
      'transformer' =&gt; function () {
        $newCSRFtoken = Craft::$app-&gt;request-&gt;getCsrfToken(); // sets a new CSRF cookie;
        return [
          'csrfTokenName' =&gt; Craft::$app-&gt;config-&gt;general-&gt;csrfTokenName,
          'csrfToken' =&gt; $newCSRFtoken,
        ];
      }
    ],


*This code is from a user on the discord server, would have linked to it but you can't ¯_(ツ)_/¯