diff --git a/src/controllers/deleteController.ts b/src/controllers/deleteController.ts
index 2fb8e0b9..d1d3ee21 100644
--- a/src/controllers/deleteController.ts
+++ b/src/controllers/deleteController.ts
@@ -2,6 +2,7 @@ import { type NextFunction, type Request, type Response } from 'express'
 import { ApiService } from '../services/apiService'
 import { CommonService } from '../services/commonService'
 import { DashboardPresenter } from '../presenters/dashboardPresenter'
+import { generateToken } from '../config/csrf'
 
 export const showDeleteKey = async (req: Request, res: Response, next: NextFunction): Promise<void> => {
   try {
@@ -9,8 +10,9 @@ export const showDeleteKey = async (req: Request, res: Response, next: NextFunct
     const customerKeyId = req.params.customerKeyId
     const apiKey = await ApiService.getKey(user, customerKeyId)
     const createdAt = DashboardPresenter.formatDate(apiKey.CreatedAt, true)
+    const csrfToken = generateToken(req, res)
 
-    res.render('delete', { apiKey, createdAt, backLinkHref: '/dashboard' })
+    res.render('delete', { apiKey, csrfToken, createdAt, backLinkHref: '/dashboard' })
   } catch (error) {
     next(error)
   }
diff --git a/views/delete.njk b/views/delete.njk
index 4260d8f5..967be590 100644
--- a/views/delete.njk
+++ b/views/delete.njk
@@ -30,6 +30,7 @@
             </table>
             <form method="POST"
                 action="/dashboard/{{ apiKey.CustomerApiKeyId }}/delete">
+                <input type="hidden" name="_csrf" value="{{csrfToken}}">
                 <div class="govuk-button-group">
                     <button class="govuk-button govuk-button--warning" data-module="govuk-button">Delete</button>
                     <a href="/dashboard" class="govuk-link">Cancel</a>