# Get the x-csrf-token Value

**URL:** <https://community.postman.com/t/get-the-x-csrf-token-value/16923>\
**Category:** Help Hub\
**Tags:** authentication\
**Created:** [October 20, 2020, 8:57am UTC](https://community.postman.com/t/get-the-x-csrf-token-value/16923 "2020-10-20T08:57:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![MouadUser](https://avatars.discourse-cdn.com/v4/letter/m/f475e1/32.png) [@MouadUser](https://community.postman.com/u/MouadUser)\
**Post date:** [October 20, 2020, 8:57am UTC](https://community.postman.com/t/get-the-x-csrf-token-value/16923/1 "2020-10-20T08:57:13Z")

</div>

Hello,

i use the following javascript code to fetch the x-csrf-token from a server.  
In postman the value is showed in the header response.

How can i access the response header using javascript. How can i get the x-csrf-token value and save it in a variable to be reused?

```auto
function test2(){

var myHeaders = new Headers();
myHeaders.append("x-csrf-token", "FETCH");
myHeaders.append("Authorization", "Basic FrtZTRIUZUIJIBHxOTpJTklUMTI=");
myHeaders.append("Cookie", "MYSAPSSO2=AjQxMDMBABhIADYAMgA0ADIAMQA5ACAAIkrnknkNKNNUBJACAAIAAgACAABAAYMgAwADIAMUHIKOKMNHVGVEANgA0ADEABQAEAAAACAYAAlgACQACRQD%2fAVcwggFTBgkqhkiG9w0BBwKgggFEMIIBQAIBATELMAkGBSsOAwIaBQAwCwYJKoZIhvcNAQcBMYIBHzCCARsCAQEwcDBkMQswCQYDVQQGEwJERTEcMBoGA1UEChMTU0FQDExMlowIwYJKoZIhvcNAQkEMRYEFBmtYzRqKDP0yD3GOybxG3tQpDFBMAkGByqGSM44BAMELzAtAhUAkNZaJuhVl9GD4I0e9gIAsrnYlCICFAmG%218eYZgS0whq6D3UOzzJFMVdR");

var requestOptions = {
  method: 'GET',
  headers: myHeaders,
  redirect: 'follow'
};

fetch("https://odataServer.de", requestOptions)
  .then(response => response.text())
  .then(result => console.log(result))
  .catch(error => console.log('error', error));

}

```

Thanks.

---

<div class="post-metadata">

**Author:** ![allenheltondev](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/allenheltondev/32/31738_2.png) [@allenheltondev](https://community.postman.com/u/allenheltondev)\
**Post date:** [October 20, 2020, 11:27am UTC](https://community.postman.com/t/get-the-x-csrf-token-value/16923/2 "2020-10-20T11:27:37Z")

</div>

The easier path here might be to move this call into its own request instead of using `fetch`. If you move it, you’d be able to use `pm.response.headers.get('x-csrf-token');` in the tests section and save that to a variable.

---

<div class="post-metadata">

**Author:** ![MouadUser](https://avatars.discourse-cdn.com/v4/letter/m/f475e1/32.png) [@MouadUser](https://community.postman.com/u/MouadUser)\
**Post date:** [October 20, 2020, 12:57pm UTC](https://community.postman.com/t/get-the-x-csrf-token-value/16923/3 "2020-10-20T12:57:10Z")

</div>

thank you for your response.

The problem i cant use the test section because i want to run this GET in a separated Application.

When i use pm.response.headers.get(‘x-csrf-token’); in the andoird application i get pm is ot defined as response.

Is the use of pm outside Postman possible?

Thank you

---

<div class="post-metadata">

**Author:** ![meenakshi.dhanani](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/meenakshi.dhanani/32/5980_2.png) [@meenakshi.dhanani](https://community.postman.com/u/meenakshi.dhanani)\
**Post date:** [October 21, 2020, 8:21am UTC](https://community.postman.com/t/get-the-x-csrf-token-value/16923/4 "2020-10-21T08:21:08Z")

</div>

Hey there,  
`pm.*` , provides access to request and response data, and variables. The pm API is basically to use within Postman context.

For an Android application, based on the language and the library(HTTP client) you use to make the request, you might want to get the response headers. For example, [this](https://stackoverflow.com/questions/18201984/get-header-from-httpurlconnection-object) issue on StackOverflow discusses how to get the response header for response returned using HttpUrlConnection as the client.