Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
CSRF risk depends on whether the browser automatically attaches credentials to a cross-site request. Cookie authentication and explicit Authorization headers therefore require different browser threat models and defenses.
CSRF matters when a browser automatically sends credentials, usually cookies, to the API on a cross-site request. An attacker site may not read the response because of CORS, but it may still cause a state-changing request if the browser includes cookies. Bearer tokens in an Authorization header are not automatically added by the browser, so the CSRF shape is different.