Level 4
The docs has a small section on that: https://laravel.com/docs/5.6/csrf#csrf-x-csrf-token
Basically setting the CSRF Token in a meta tag inside your app.blade.php file (or whatever file is your main template each view is extending) and getting the meta value to set it in your XHR method of choice (axios, jQuery...).