because the token is valid for the curent session , so when you fetch it via curl is a session different from the client sessions
public function getCsrfToken($key = null) {
$session_id = session_id();
if ($key == null)
$key = $this->csrf_token_key;
// Prefer computing CSRF using HMAC
if (function_exists("hash_hmac"))
return hash_hmac("sha256", $session_id, $key);
// Sha256 hash is the next best thing
if (function_exists("hash"))
return hash("sha256", $key . $session_id);
// Regretably, fallback to md5
return md5($key . $session_id);
}