Vue js - invalid csrf token in /oauth2/authorize

Yes, the whole point of the ‘token’ auth flow is that the access token is provided in the URL hash, so you would use window.location.hash to get the params from hash which you can then use for API requests in the frontend.