What is the `authjs.callback-url` cookie?no consent needed

Set by NextAuth.js (Auth.js) (The website (Auth.js)). Expires after Session.

Strictly necessary — it can load freely

Cookies essential to the service are exempt from consent under ePrivacy Art. 5(3) — but authjs.callback-url must still be disclosed in your cookie policy.

Purpose

Remembers where to send the visitor after they sign in.

Cookie details

Cookie name: authjs.callback-url
Service: NextAuth.js (Auth.js)
Provider: The website (Auth.js)
Category: Strictly Necessary
Duration: Session
Consent: Not required

GDPR requirements

Strictly necessary cookies are essential for the website to function and cannot be switched off. They are set only in response to actions made by you — such as logging in or filling forms. No consent is required.

For authjs.callback-url to be compliant, it must be:

May be set as soon as the visitor arrives — no consent needed
Still disclosed in your cookie policy, with what it does and why it is necessary
Not shown as a toggle in your consent banner

How to handle it

1
Let it load freely
No consent gate is needed for this cookie.
2
Disclose it
List it in your cookie policy as strictly necessary for NextAuth.js (Auth.js).
3
Keep it out of the toggles
Strictly necessary cookies shouldn't be switchable in your consent UI.