---
title: CSRF prevention
description: "**Note** Relevant for all those who use the old ChurchTools API. CSRF stands for [Cross-Site-Request-Forgery](https://developer.mozilla.org/en-US/docs/Glossary/CSRF) and describes an attack in which unwanted actions are triggered via a user in order to abuse their rights. To prevent ChurchTools from being vulnerable…"
url: "https://staging.churchtools.academy/en/help/system-settings/general-data-security-privacy/csrf-prevention/"
updated: "2026-08-10"
category: Data Security/Privacy / General
---

# CSRF prevention

**Note**

Relevant for all those who use the old ChurchTools API.

CSRF stands for [Cross-Site-Request-Forgery](https://developer.mozilla.org/en-US/docs/Glossary/CSRF) and describes an attack in which unwanted actions are triggered via a user in order to abuse their rights. To prevent ChurchTools from being vulnerable to CSRF attacks, we have introduced a CSRF token. This must be sent as a header with all old API calls. Specifically, this applies to all POST requests that have the content type application/x-www-form-urlencoded or set. We explain how to do this in this article.

After you have logged in, you call up the API `/api/csrftoken` to get the token. You then send this token as a header with every subsequent API request. The header looks like this:

`CSRF-Token: $MEIN_TOKEN`

**Warning**

The CSRF token check can currently still be deactivated in the System settings. However, we strongly recommend that you do not do this, as this is a security risk.

This option will be removed in a future version and the verification of the CSRF token will then always be active.

## Article to read more

- [Overview API](https://staging.churchtools.academy/en/help/system-settings/api-en/overview-api/)