This is how the core achieves this:
Javascript
file: vendor/magento/module-checkout/view/frontend/web/js/view/payment.js:98getFormKey: function () { return window.checkoutConfig.formKey;}
HTML
file: vendor/magento/module-checkout/view/frontend/web/template/payment.html:19<form id="co-payment-form" class="form payments" novalidate="novalidate"> <input data-bind='attr: {value: getFormKey()}' type="hidden" name="form_key"/> ...</form>