Do you need CSRF protection in the API?

Question

API

Hello, I am making an API on nodeJs using the restify plugin, I use JWT for authorization. And I have a question: is it necessary to protect against such an attack in the API?

Answer 1

No, the jwt issued token already fulfills this function

Answer 2

No.
CSRF, as the name Cross Site Request Forgery implies, is only needed to check access from the site (from the browser) and protect against bots.
The API, as the name suggests, the Application Programming Interface, on the contrary, is designed for bots.

Answer 3

In this case, CORS is used to control access sources.