> For the complete documentation index, see [llms.txt](/docs/llms.txt)

# Login Page Cookies | FusionAuth Docs

Learn about the cookies set by FusionAuth.

# Login Page Cookies

Cookies are a critical part of web applications.

When you call certain APIs, such as the Login API, cookies may be set. Such cookies are specified in the [API documentation](/docs/apis/).

When you use the [hosted login pages](/docs/get-started/core-concepts/integration-points#hosted-login-pages), the [hosted backend](/docs/apis/hosted-backend) or [interact with the APIs](/docs/apis/), FusionAuth uses cookies to enable functionality.

## Domains[#](#domains)

The domain of all cookies is the domain on which the FusionAuth instance is running. You can control the domain FusionAuth uses by [setting up a proxy](/docs/operate/deploy/proxy-setup).

In other words, if FusionAuth serves requests at `auth.piedpiper.com`, it will only set cookies for this value: `auth.piedpiper.com`. It will never set cookies for `.piedpiper.com`. The ability to control the domain of the cookie set is an [open feature request](https://github.com/FusionAuth/fusionauth-issues/issues/1991).

Additionally, most cookies set by FusionAuth will use the [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value) value of `Strict` or `Lax`. This is to protect against [Cross-Site Request Forgery (CSRF)](https://owasp.org/www-community/attacks/csrf). Practically, it means a browser will block those cookies on a cross-site request unless the browser is navigating to the origin site from an external site, which is something to consider if you intend to access FusionAuth from a different domain using something like an IFRAME.

## Cookie List[#](#cookie-list)

Cookies set by the hosted login pages are displayed here for informational purposes only. The name, type and description of each cookie are subject to change.

| Name | Type | Description |
| --- | --- | --- |
| `access_token` | Session | The access token. Set by the login API. |
| `app.at` | Persistent | The access token. Set by the hosted backend. |
| `app.at_exp` | Persistent | The access token expiration. Set by the hosted backend. |
| `app.idt` | Persistent | The Id token. Set by the hosted backend. |
| `app.pkce_v` | Persistent | The PKCE verifier. Set by the hosted backend. |
| `app.rt` | Persistent | The refresh token. Set by the hosted backend. |
| `fa.bypass-c` | Session | Implements security functionality. |
| `fa.bypass-c.csrf` | Session | Implements security functionality. |
| `federated.csrf` | Session | Implements security functionality. |
| `fusionauth.app.pkce-verifier` | Request | Used to support Proof Key for Code Exchange during login. |
| `fusionauth.csrf` | Session | Implements security functionality. |
| `fusionauth.flash-message` | Request | Used to display a message across requests. |
| `fusionauth.known-device.*` | Persistent | Identifies a device known to FusionAuth. More than one cookie may be set. |
| `fusionauth.li` | Session | Used to support post-authentication steps during login. |
| `fusionauth.locale` | Persistent | The locale used to localize the themed pages. |
| `fusionauth.pkce-verifier` | Request | Implements security functionality. |
| `fusionauth.remember-device` | Persistent | Records whether the user wants to remain logged in on this device. |
| `fusionauth.sso` | Persistent | Represents a single sign-on session. |
| `fusionauth.timezone` | Persistent | The configured or approximated timezone used to adjust displayed dates and times. |
| `fusionauth.trust` | Persistent | Allows a MFA challenge to be bypassed during login. |
| `fusionauth.trust_c` | Request | Implements security functionality. |
| `fusionauth.trust_t` | Request | Implements security functionality. |
| `fusionauth.trusted-device.*` | Persistent | Identifies a trusted device. More than one cookie may be set. |
| `fusionauth.webauthn-reauth.*` | Persistent | Records user choices about WebAuthn and passkeys. More than one cookie may be set. |
| `refresh_token` | Persistent | The refresh token when the login API is used. |
| `saml.csrf` | Session | Implements security functionality. |