Hey!
Have you checked if all of your domains are allowed to query the endpoint? The CSRF token encrypted and then stored in a cookie or return as response header. The cookie itself is also session bound and so specific to a domain. There are may possibilities where this may not work. Are you using Sanctum or likewise for the API stuff or is this a custom built API?
Best wishes Tom
Sign in to participate in this thread!
Laravel
Laravel News
Laracasts
Laravel Podcast