@PitaJ @julian
Apologies for not replying and thank you for the suggestions!
I figured out the issue with csrf. I had to set the config url to be that of my client app instead of the nodebb instance.
Using this I'm able to request the csrf token from the config endpoint and use that in subsequent requests.