My take: API and AJAX are not the same thing.
API is stateless, requires JWT, and is really for things ling mobile apps, micro-services and such, serving up resources. They can be consumed.
Ajax is really just a web route used for internal app purposes like interactive UIs. You simply apply a 'web' route to it. They can't be consumed. Only the app should be making the calls to these routes. So you can enforce CSRF, etc with web middleware, etc.
The way I do it, I break up my routes...
routes/web.php // web middleware
routes/ajax.php // web middleware
routes/api.php // api middleware
I prefix my Ajax routes to look like this /ajax/do-foo.