Creating an API via module routing files that includes csrf verification headers
The requirement _csrf_request_header_token: &quot;TRUE&quot; works only if user is connected because CsrfRequestHeaderAccessCheck use session informations.
If you look at CsrfRequestHeaderAccessCheck in the access method there is:
 if ($account
      -&gt;isAuthenticated() &amp;&amp; $this-&gt;sessionConfiguration
      -&gt;hasSession($request)) {

To check if the user is connected and it there is a session identifier in the request if it's not it will go directly to:
// Let other access checkers decide if the request is legit.
    return AccessResult::allowed()-&gt;setCacheMaxAge(0);

so it will not check if X-CSRF-Token is in the headers or not even if you set the route requirement _csrf_request_header_token: &quot;TRUE&quot;.
Code
MODULE.routing.yml
MODULE.login:
  path: &quot;/api/v1/user/login&quot;
  defaults:
    _title: &quot;User API Login&quot;
    _controller: '\Drupal\MODULE\Controller\UserAPIController::login'
  methods: 'POST'
  requirements:
    _csrf_request_header_token: 'TRUE'

UserAPIController.php
class UserAPIController extends ControllerBase {
  
  public function login(Request $request) {
    $response['data'] = 'Some test data to return';
    $response['method'] = 'POST';

    return new JsonResponse( $response );
  }

}

Test

With Connected user

with anonymous user