How and is it possible to make csfr protection on a separate web application?

Question

Information Security

There is a front written in vue (example.com)
And there is a separate laravel project used as api (api.example.com) (together with laravel passport)
How and is it possible to use CSFR protection here if these two "sites" are on different domains? As I understand it, this can only be arranged if they are physically in the same place. Is it so?
And if not, is there any other way to protect?
There is only CORS, but I don't know how much of a system protection it is.

Answer 1

It can be done if you store the session and the CSRF tag in the database.