diff --git a/includes/ApiScribuntoConsole.php b/includes/ApiScribuntoConsole.php
index 95385f6c..20cf14b5 100644
--- a/includes/ApiScribuntoConsole.php
+++ b/includes/ApiScribuntoConsole.php
@@ -145,6 +145,10 @@ protected function newSession() {
 		];
 	}
 
+	public function needsToken() {
+		return 'csrf';
+	}
+
 	public function isInternal() {
 		return true;
 	}
diff --git a/modules/ext.scribunto.edit.js b/modules/ext.scribunto.edit.js
index cfe3d877..407f6e00 100644
--- a/modules/ext.scribunto.edit.js
+++ b/modules/ext.scribunto.edit.js
@@ -280,7 +280,7 @@
 		api = new mw.Api();
 		setPending();
 
-		api.post( params )
+		api.postWithToken( 'csrf', params )
 			.done( function ( result ) {
 				if ( result.sessionIsNew === '' && !sentContent ) {
 					// Session was lost. Resend query, with content