Session-authenticated endpoints accept either an Authorization bearer token or the browser's same-origin access_token cookie. Cookie-backed POST, PUT, PATCH, and DELETE requests automatically reuse the csrf_token cookie as X-CSRF-Token in these docs.