setCookie(name, value, [options])
Sets a cookie on the response. Available in API scripts and the site router — pages are rendered once and shared, so they cannot set cookies.
Parameters
namestringrequiredThe cookie name: letters, digits, -, _ and .. Docly's own names throw: auth, auth2, adminoverride, access_token (use writeJwt) and names starting with _doauth_.
valuestringrequiredThe value, stored as text. Name and value together at most 4096 bytes.
optionsobjectoptionalmaxAge — seconds until it expires; leave it out for a session cookie, 0 deletes it.
httpOnly — default true: scripts in the browser cannot read it.
sameSite — "Lax" (default), "Strict" or "None"; "None" requires HTTPS.
path — default the site's root path.
Returns
Nothing. The cookie is sent with the response — in the site router with every result, also a redirect or an answer such as route.json. Secure is set automatically on HTTPS. Setting the same name twice in one request keeps the last value.
SameSite=Lax is the default because a sign-in that returns from another site (OAuth) needs the cookie on that first request. Use "Strict" for cookies that never take part in a flow across sites.
Example
// Remember a choice for a year
docly.setCookie("theme", "dark", { maxAge: 365 * 24 * 3600 });
// A short-lived value for a sign-in round trip (see The site router)
docly.setCookie("oauth_state", guid(), { maxAge: 600 });
// Delete it again
docly.setCookie("oauth_state", "", { maxAge: 0 });