# CSRF token from either the request body or request headers did not match or is missing **URL:** \ **Category:** API & Customization issues\ **Created:** [February 7, 2023, 11:44am UTC](https://community.passbolt.com/t/csrf-token-from-either-the-request-body-or-request-headers-did-not-match-or-is-missing/6488 "2023-02-07T11:44:18Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Egor](https://avatars.discourse-cdn.com/v4/letter/e/6de8d8/32.png) [@Egor](https://community.passbolt.com/u/Egor)\ **Post date:** [February 7, 2023, 11:44am UTC](https://community.passbolt.com/t/csrf-token-from-either-the-request-body-or-request-headers-did-not-match-or-is-missing/6488/1 "2023-02-07T11:44:18Z")
Good day. I use Passbolt Api for creating entries in passbolt. But I have problem with session checking. Every request I check session by method /auth/is-authenticated.json. But I think the session has a lifetime and I have got error when I tried to create entry CSRF token from either the request body or request headers did not match or is missing.“,“url”:”/resources.json?api-version=v2",“code”:403 But /healthcheck.json?api-version=v2 return 200 at this time. How i can check csrf token and session? ---
**Author:** ![garrett](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/garrett/32/545_2.png) [@garrett](https://community.passbolt.com/u/garrett)\ **Post date:** [February 7, 2023, 1:20pm UTC](https://community.passbolt.com/t/csrf-token-from-either-the-request-body-or-request-headers-did-not-match-or-is-missing/6488/2 "2023-02-07T13:20:11Z")
Hi @Egor Welcome to the forum! Yes there is an authentication sequence which is described here [Passbolt Help | Authentication in passbolt](https://help.passbolt.com/api/authentication) This thread has helpful related links as well [How to complete initial API auth steps using Postman?](https://community.passbolt.com/t/how-to-complete-initial-api-auth-steps-using-postman/4792) ---
**Author:** ![Egor](https://avatars.discourse-cdn.com/v4/letter/e/6de8d8/32.png) [@Egor](https://community.passbolt.com/u/Egor)\ **Post date:** [February 7, 2023, 2:03pm UTC](https://community.passbolt.com/t/csrf-token-from-either-the-request-body-or-request-headers-did-not-match-or-is-missing/6488/3 "2023-02-07T14:03:24Z")
Hi @garrett! Thank you for the fast response. I can able to successfully complete the login steps and steps for creating entries by my service. And i store session id and csrf token, then some time passes and my service trying to create entry again with checking session by method /auth/is-authenticated.json. And then I get an error “CSRF token from either the request body or request headers did not match or is missing”. How can I check that I need to repeat login steps again? ---
**Author:** ![garrett](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/garrett/32/545_2.png) [@garrett](https://community.passbolt.com/u/garrett)\ **Post date:** [February 7, 2023, 2:09pm UTC](https://community.passbolt.com/t/csrf-token-from-either-the-request-body-or-request-headers-did-not-match-or-is-missing/6488/4 "2023-02-07T14:09:34Z")
I believe it’s considered normal to reauthenticate every call, but that may have changed. And I would add that the error you are receiving would also be a good way to know. ---
**Author:** ![Egor](https://avatars.discourse-cdn.com/v4/letter/e/6de8d8/32.png) [@Egor](https://community.passbolt.com/u/Egor)\ **Post date:** [February 8, 2023, 2:22pm UTC](https://community.passbolt.com/t/csrf-token-from-either-the-request-body-or-request-headers-did-not-match-or-is-missing/6488/5 "2023-02-08T14:22:58Z")
I am trying to repeat the login every request. I call /auth/logout.json but then i make another request with login’s steps and I don’t receive csrf token by method users/me.json?api-version=v2. This response doesn’t have header set-cookie. I think I need to reset session but I cannot imagine how ---
**Author:** ![garrett](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/garrett/32/545_2.png) [@garrett](https://community.passbolt.com/u/garrett)\ **Post date:** [February 8, 2023, 3:18pm UTC](https://community.passbolt.com/t/csrf-token-from-either-the-request-body-or-request-headers-did-not-match-or-is-missing/6488/6 "2023-02-08T15:18:28Z")
I think stateless with JWTs is in the works but it’s session based with a cookie at the moment and your former approach should incorporate the timed out response which requires reauthentication. The first step then would be to check like you were saying above: > [@Egor](#): > > checking session by method /auth/is-authenticated.json. > And then I get an error “CSRF token from either the request body or request headers did not match or is missing”. Authenticate again when this happens.