What is the sb-*-auth-token cookie?no consent needed
Set by Supabase (The website (Supabase Auth)). Expires after Up to 400 days.
Strictly necessary — it can load freely
Cookies essential to the service are exempt from consent under ePrivacy Art. 5(3) — but sb-*-auth-token must still be disclosed in your cookie policy.
Purpose
Holds the Supabase Auth session (access and refresh token) for the signed-in user.
Named after the project reference, e.g. sb-abcdefgh-auth-token. Large sessions are split into .0, .1 … chunks.
Cookie details
- Cookie name
sb-*-auth-token- Service
- Supabase
- Provider
- The website (Supabase Auth)
- Category
- Strictly Necessary
- Duration
- Up to 400 days
- Consent
- Not required
GDPR requirements
Strictly necessary cookies are essential for the website to function and cannot be switched off. They are set only in response to actions made by you — such as logging in or filling forms. No consent is required.
For sb-*-auth-token to be compliant, it must be:
- May be set as soon as the visitor arrives — no consent needed
- Still disclosed in your cookie policy, with what it does and why it is necessary
- Not shown as a toggle in your consent banner
How to handle it
- 1Let it load freely
No consent gate is needed for this cookie.
- 2Disclose it
List it in your cookie policy as strictly necessary for Supabase.
- 3Keep it out of the toggles
Strictly necessary cookies shouldn't be switchable in your consent UI.
is sb-*-auth-token on your site?scan it in 2 minutes
Free scan · see every cookie before and after consent