API requests (ie: calls from your Vue/Axios) should be in the api.php routes and not web.php. Those automatically will not have CSRF.
Next, like you mentioned, you'll need to have users login from your frontend and the axios response, you'll need to save the user token somewhere. A suggested place for this would be your browser local storage.
You should also have a Vuex store set up (let's call it users.js) that stores whether or not the user is logged in, and also has a state variable for the token (fetches it from local storage).
Final step of the puzzle is an axios.js file that's a helper file that you'll import in your Vue frontend instead of importing the regular axios. Code could be as below:
import axios from 'axios';
let axiosInstance = axios.create();
axiosInstance.interceptors.request.use( async config => {
if(localStorage.getItem('token')) {
config.headers['Authorization'] = 'Bearer ' + localStorage.getItem('token');
}
return config;
}, error => Promise.reject(error) );
export default axiosInstance;
Basically what it does is create an axios instance, check if the local storage contains a token, and if so, it adds it to the header of the requests.
If your route is in the correct middleware in api.php and you sent the token properly in the header, you should now have authenticated users.