As stated in the official docs, the JSON API CSRF protection only works from within Wordpress.It is important to keep in