hanilkathuria oh right now I remember the error message is different on those endpoints. But it's essentially the same, the CSRF token you passed is invalid.
I'm not really sure what you have so far and what you are trying to do. Can you explain what you are trying to implement? Even the original post in this discussion doesn't go into deep details so it's impossible to tell if your situation is exactly the same or not.
The easier for a kind of login-to-webview or "global login from external app" implementation is usually to request a token through the /tokens API endpoint, then use that token to start a session via the "remember me" cookie.
I think that by default /tokens is still CSRF-protected, but the protection can be disabled via our extenders or by creating a proxy script that will call that endpoint with an API Key.
