For example I am using next js and express for api and I want to implement a custom csrf token generator and validator like jwt we can generate and validate. so we donreq the api for csrf token we generate our own with some kind of secret then validate that.