setCookie(name, value, [options]) Last updated: 20. Oct 2026

API only function

Sets a cookie on the response. Available in API scripts and the site router — pages are rendered once and shared, so they cannot set cookies.

See also: getCookie setHeader writeJwt

Parameters

Name	Type	Description
name	string	The cookie name: letters, digits, `-`, `_` and `.`. Docly's own names throw: `auth`, `auth2`, `adminoverride`, `access_token` (use writeJwt) and names starting with `_doauth_`.
value	string	The value, stored as text. Name and value together at most 4096 bytes.
options (optional)	object	`maxAge` — seconds until it expires; leave it out for a session cookie, `0` deletes it. `httpOnly` — default `true`: scripts in the browser cannot read it. `sameSite` — `"Lax"` (default), `"Strict"` or `"None"`; `"None"` requires HTTPS. `path` — default the site's root path.

Returns

Nothing. The cookie is sent with the response — in the site router with every result, also a redirect or an answer such as route.json. Secure is set automatically on HTTPS. Setting the same name twice in one request keeps the last value.

SameSite=Lax is the default because a sign-in that returns from another site (OAuth) needs the cookie on that first request. Use "Strict" for cookies that never take part in a flow across sites.

Example

Code example (JS)

JS is normal JavaScript either running in the browser or on the Docly™ server.

// Remember a choice for a year
docly.setCookie("theme", "dark", { maxAge: 365 * 24 * 3600 });

// A short-lived value for a sign-in round trip (see The site router)
docly.setCookie("oauth_state", guid(), { maxAge: 600 });

// Delete it again
docly.setCookie("oauth_state", "", { maxAge: 0 });