diff --git a/resources/views/auth/login.blade.php b/resources/views/auth/login.blade.php
index 797e750..cf5d4d2 100644
--- a/resources/views/auth/login.blade.php
+++ b/resources/views/auth/login.blade.php
@@ -164,11 +164,15 @@
         };
 
         try {
+            const csrf = document.querySelector('meta[name="csrf-token"]')?.content ?? '';
             const res = await fetch('/api/v1/auth/login', {
                 method: 'POST',
+                credentials: 'same-origin',
                 headers: {
                     'Content-Type': 'application/json',
                     'Accept': 'application/json',
+                    'X-CSRF-TOKEN': csrf,
+                    'X-Requested-With': 'XMLHttpRequest',
                 },
                 body: JSON.stringify(payload),
             });
diff --git a/resources/views/dashboard.blade.php b/resources/views/dashboard.blade.php
index 5738f5c..ba78298 100644
--- a/resources/views/dashboard.blade.php
+++ b/resources/views/dashboard.blade.php
@@ -91,9 +91,16 @@
 
     document.getElementById('logout-btn').addEventListener('click', async () => {
         try {
+            const csrf = document.querySelector('meta[name="csrf-token"]')?.content ?? '';
             await fetch('/api/v1/auth/logout', {
                 method: 'POST',
-                headers: { 'Authorization': `Bearer ${token}`, 'Accept': 'application/json' },
+                credentials: 'same-origin',
+                headers: {
+                    'Authorization': `Bearer ${token}`,
+                    'Accept': 'application/json',
+                    'X-CSRF-TOKEN': csrf,
+                    'X-Requested-With': 'XMLHttpRequest',
+                },
             });
         } catch {}
         localStorage.removeItem('verde:token');