The Prelude Session API uses cookies to manage authentication and verification processes securely.

Modern web browsers block third-party cookies by default. To ensure that the cookies necessary for the Session API to work correctly won’t be blocked, you need to set up a custom domain name that is a subdomain of the domain your application is hosted on.

There are two primary types of cookies used by the API:

​
Refresh Cookies

Cookie Name: __refresh_{app_id}

Refresh cookies are used to maintain user sessions and enable the generation of new access tokens without requiring users to re-authenticate. These cookies are:

  • Sent to the client after successful authentication
  • Used in the /v1/session/refresh endpoint to obtain new access tokens
  • Required for the /v1/session/revoke endpoint when logging out

​
Verification Cookies

Cookie Name: __verification-login_{app_id}

Verification cookies are used during the authentication process to maintain state between verification steps. These cookies:

  • Store temporary verification state during multi-step authentication flows
  • Are used with the verification endpoints for both phone and email verification
  • Are automatically cleared once the verification process is complete

Both cookie types are designed with security in mind and include appropriate flags for secure transmission and storage.