CSRF Tokens, Capturing Dynamically

What is the typical CSRF token capture pattern for scrapers?

• AHard-code the token from a captured curl
• BGET the page (or a /csrf endpoint), extract the token from HTML/JSON, then include it on the POST
• CGenerate a random token client-side
• DSkip CSRF and use Authorization headers