What is the best way to append CSRF token without using a form?
You need to pass the token and name into javascript. Easiest is to just have a script tag somewhere.

&lt;script type="text/javascript"&gt;
    window.csrfTokenName = "{{ craft.config.csrfTokenName }}";
    window.csrfTokenValue = "{{ craft.request.csrfTokenValue }}";
&lt;/script&gt;


Now they will be available to your ajax call.