diff --git a/application/controllers/Api.php b/application/controllers/Api.php
index 4ae4f64d5..bfb79feff 100644
--- a/application/controllers/Api.php
+++ b/application/controllers/Api.php
@@ -83,14 +83,23 @@ class API extends CI_Controller {
 
 	}
 
-	function generate($rights) {
+	function generate() {
+		// CSRF mitigation: reject non-POST requests
+		if ($this->input->method() !== 'post') {
+			$this->session->set_flashdata('error', __("Invalid request method"));
+			redirect('api');
+			return;
+		}
+
 		$this->load->model('user_model');
 		if(!$this->user_model->authorize(3)) { $this->session->set_flashdata('error', __("You're not allowed to do that!")); redirect('dashboard'); }
 
+		$rights = $this->input->post('rights', TRUE);
+
 		if ($rights !== "r" && $rights !== "rw") {
 			$this->session->set_flashdata('error', __("Invalid API rights"));
 			redirect('api');
-			exit;
+			return;
 		}
 
 		$this->load->model('api_model');
@@ -109,10 +118,23 @@ class API extends CI_Controller {
 		redirect('api');
 	}
 
-	function delete($key) {
+	function delete() {
+		// CSRF mitigation: reject non-POST requests
+		if ($this->input->method() !== 'post') {
+			$this->session->set_flashdata('error', __("Invalid request method"));
+			redirect('api');
+			return;
+		}
+
 		$this->load->model('user_model');
 		if(!$this->user_model->authorize(3)) { $this->session->set_flashdata('error', __("You're not allowed to do that!")); redirect('dashboard'); }
 
+		$key = $this->input->post('key', TRUE);
+		if (empty($key)) {
+			$this->session->set_flashdata('error', __("Invalid API Key"));
+			redirect('api');
+			return;
+		}
 
 		$this->load->model('api_model');
 
diff --git a/application/views/api/index.php b/application/views/api/index.php
index 8c71b1b59..ffe50299b 100644
--- a/application/views/api/index.php
+++ b/application/views/api/index.php
@@ -78,7 +78,13 @@
 										<?php
 											$cfnm_delete = sprintf(__("Are you sure you want delete the API Key %s?"), '&quot;'.($row->description ?? '<noname>').'&quot;');
 										?>
-										<a href="<?php echo site_url('api/delete/' . $api_key); ?>" class="btn btn-danger btn-sm" onclick="return confirm('<?php echo $cfnm_delete; ?>');"><?= __("Delete"); ?></a>
+										<form method="post" action="<?php echo site_url('api/delete'); ?>" style="display:inline;">
+											<input type="hidden" name="key" value="<?php echo $api_key; ?>">
+											<button type="submit" class="btn btn-danger btn-sm"
+												onclick="return confirm('<?php echo $cfnm_delete; ?>');">
+												<?= __("Delete"); ?>
+											</button>
+										</form>
 									<?php } ?>
 								</td>
 
@@ -93,8 +99,18 @@
 			<?php } ?>
 
 			<p>
-				<a href="<?php echo site_url('api/generate/rw'); ?>" class="btn btn-primary "><i class="fas fa-plus"></i> <?= __("Create a read & write key"); ?></a>
-				<a href="<?php echo site_url('api/generate/r'); ?>" class="btn btn-primary"><i class="fas fa-plus"></i> <?= __("Create a read-only key"); ?></a>
+				<form method="post" action="<?php echo site_url('api/generate'); ?>" style="display:inline;">
+					<input type="hidden" name="rights" value="rw">
+					<button type="submit" class="btn btn-primary">
+						<i class="fas fa-plus"></i> <?= __("Create a read & write key"); ?>
+					</button>
+				</form>
+				<form method="post" action="<?php echo site_url('api/generate'); ?>" style="display:inline;">
+					<input type="hidden" name="rights" value="r">
+					<button type="submit" class="btn btn-primary">
+						<i class="fas fa-plus"></i> <?= __("Create a read-only key"); ?>
+					</button>
+				</form>
 			</p>
 
 		</div>