# CSRF token mismatch While creating REST API

**URL:** <https://discourse.cakephp.org/t/csrf-token-mismatch-while-creating-rest-api/4933>\
**Category:** Need Help\
**Created:** [September 15, 2018, 6:53am UTC](https://discourse.cakephp.org/t/csrf-token-mismatch-while-creating-rest-api/4933 "2018-09-15T06:53:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![aneh](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/aneh/32/408_2.png) [@aneh](https://discourse.cakephp.org/u/aneh)\
**Post date:** [September 15, 2018, 6:53am UTC](https://discourse.cakephp.org/t/csrf-token-mismatch-while-creating-rest-api/4933/1 "2018-09-15T06:53:43Z")

</div>

HI, I am creating a REST API for Android and iOS using CakePHP 3. I am using CakePHP 3 JWT plugin but whenever I create post request from postman I get this error.

```
{
    "message": "CSRF token mismatch.",
    "url": "/api/login",
    "code": 403,
    "file": "/var/www/html/hospital/vendor/cakephp/cakephp/src/Http/Middleware/CsrfProtectionMiddleware.php",
    "line": 195
}

```

Can you please help to fix this. I am using latest version of CakePHP 3

---

<div class="post-metadata">

**Author:** ![FinlayDaG33k](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/finlaydag33k/32/1049_2.png) [@FinlayDaG33k](https://discourse.cakephp.org/u/FinlayDaG33k)\
**Post date:** [September 15, 2018, 8:15am UTC](https://discourse.cakephp.org/t/csrf-token-mismatch-while-creating-rest-api/4933/2 "2018-09-15T08:15:33Z")

</div>

Are you sure you’re sending the CSRF token with the request? (either by sending it using the `X-CSRF-Token` header or by setting the `csrfToken` cookie, but I recommend using the header)