the following API endpoints were used to obtain a token:
‘rctoken’ in action=query&list=recentchanges 
‘rvtoken’ in action=query&prop=revisions 
‘intoken’ in action=query&prop=info 
‘ustoken’ in action=query&list=users
[…] clients now need to use a consolidated ‘action=query&meta=tokens’ endpoint.
It took me a little while to figure out the correct replacement in some cases. Especially uiprop=preferencestoken and "type=edit" since "preferences" and "edit" are not accepted by the new API as valid types.
It is not mentioned anywhere on the relevant pages, but I understand these essentially fall in the bucket of general csrf tokens now. I remember that from years ago, but did not connect the dots with the API module change at the same time.
I've captured various bits of information and links together on this wiki page: