# Login Page Cookies

Learn about the cookies set by FusionAuth.

> For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt)

Cookies are a critical part of web applications.

When you call certain APIs, such as the Login API, cookies may be set. Such cookies are specified in the [API documentation](https://fusionauth.io/docs/apis.md).

When you use the [hosted login pages](https://fusionauth.io/docs/concepts/integration-points.md#hosted-login-pages), the [hosted backend](https://fusionauth.io/docs/apis/hosted-backend.md) or [interact with the APIs](https://fusionauth.io/docs/apis.md), FusionAuth uses cookies to enable functionality.

## Domains

The domain of all cookies is the domain on which the FusionAuth instance is running. You can control the domain FusionAuth uses by [setting up a proxy](https://fusionauth.io/docs/deploy/production/proxy-setup.md).

In other words, if FusionAuth serves requests at `auth.piedpiper.com`, it will only set cookies for this value: `auth.piedpiper.com`. It will never set cookies for `.piedpiper.com`. The ability to control the domain of the cookie set is an [open feature request](https://github.com/FusionAuth/fusionauth-issues/issues/1991).

Additionally, most cookies set by FusionAuth will use the [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value) value of `Strict` or `Lax`. This is to protect against [Cross-Site Request Forgery (CSRF)](https://owasp.org/www-community/attacks/csrf). Practically, it means a browser will block those cookies on a cross-site request unless the browser is navigating to the origin site from an external site, which is something to consider if you intend to access FusionAuth from a different domain using something like an IFRAME.

## Cookie List

Caution

Cookies set by the hosted login pages are displayed here for informational purposes only. The name, type and description of each cookie are subject to change.

| Name | Type | Description |
| --- | --- | --- |
| `access_token` | Session | The access token. Set by the login API. |
| `app.at` | Persistent | The access token. Set by the hosted backend. |
| `app.at_exp` | Persistent | The access token expiration. Set by the hosted backend. |
| `app.idt` | Persistent | The Id token. Set by the hosted backend. |
| `app.pkce_v` | Persistent | The PKCE verifier. Set by the hosted backend. |
| `app.rt` | Persistent | The refresh token. Set by the hosted backend. |
| `fa.bypass-c` | Session | Implements security functionality. |
| `fa.bypass-c.csrf` | Session | Implements security functionality. |
| `federated.csrf` | Session | Implements security functionality. |
| `fusionauth.app.pkce-verifier` | Request | Used to support Proof Key for Code Exchange during login. |
| `fusionauth.csrf` | Session | Implements security functionality. |
| `fusionauth.flash-message` | Request | Used to display a message across requests. |
| `fusionauth.known-device.*` | Persistent | Identifies a device known to FusionAuth. More than one cookie may be set. |
| `fusionauth.li` | Session | Used to support post-authentication steps during login. |
| `fusionauth.locale` | Persistent | The locale used to localize the themed pages. |
| `fusionauth.pkce-verifier` | Request | Implements security functionality. |
| `fusionauth.remember-device` | Persistent | Records whether the user wants to remain logged in on this device. |
| `fusionauth.sso` | Persistent | Represents a single sign-on session. |
| `fusionauth.timezone` | Persistent | The configured or approximated timezone used to adjust displayed dates and times. |
| `fusionauth.trust` | Persistent | Allows a MFA challenge to be bypassed during login. |
| `fusionauth.trust_c` | Request | Implements security functionality. |
| `fusionauth.trust_t` | Request | Implements security functionality. |
| `fusionauth.trusted-device.*` | Persistent | Identifies a trusted device. More than one cookie may be set. |
| `fusionauth.webauthn-reauth.*` | Persistent | Records user choices about WebAuthn and passkeys. More than one cookie may be set. |
| `refresh_token` | Persistent | The refresh token when the login API is used. |
| `saml.csrf` | Session | Implements security functionality. |

Related

[APIs Data Types Learn about the different data types used by FusionAuth. reference](https://fusionauth.io/docs/apis/data-types.md)

[Concepts Indexed Entity Fields Learn about the entity fields that are indexed and searchable. reference](https://fusionauth.io/docs/concepts/types/entity-fields.md)

[Users Indexed User Fields Learn about the user fields that are indexed and searchable. reference](https://fusionauth.io/docs/users/search/user-fields.md)
---

## Other pages in Authentication

> For the full index of this section, see [Authentication](https://fusionauth.io/docs/llms-authentication.txt).

- [Application Authentication Tokens](https://fusionauth.io/docs/authentication/application-authentication-tokens.md): Leverage Application specific authentication tokens to speed up certain authentication tasks.
- [Authentication Types](https://fusionauth.io/docs/authentication/authentication-types.md): Learn about the supported types of authentication.
- [Add an Identity Provider (IdP)](https://fusionauth.io/docs/authentication/identity-providers.md): Learn how to let users log in through an external identity provider such as Google or Okta.
- [Build a Login Page with the Login API](https://fusionauth.io/docs/authentication/login-api.md): Learn about the Login API and when you would use it.
- [Multi-Factor Authentication (MFA)](https://fusionauth.io/docs/authentication/multi-factor-authentication.md): Learn about how to use multi-factor authentication (MFA) in FusionAuth as a developer.
- [OAuth](https://fusionauth.io/docs/authentication/oauth.md): Learn about the OAuth 2.0 and OpenID Connect grants FusionAuth supports for login and single sign-on.
- [One-Time Passwords](https://fusionauth.io/docs/authentication/one-time-passwords.md): Create a passwordless experience using magic links and one-time passwords.
- [Passkeys](https://fusionauth.io/docs/authentication/passkeys.md): Learn about passkeys, which let users log in with a device instead of a password.