> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

# Cookies

> The first-party cookies Catalyst sets on the storefront domain by default, with their purpose, consent category, and expiry.

Catalyst sets the following first-party cookies on the storefront domain by default. No third-party cookies are set by Catalyst itself; additional cookies may be introduced by scripts configured in Script Manager, subject to each shopper's consent choices.

> **Warning**
>
> This page describes Catalyst's default cookie behavior. It is not legal advice. Store owners are solely responsible for ensuring their storefront's use of cookies complies with all applicable privacy laws in the jurisdictions where they operate. We recommend consulting qualified legal counsel to assess your specific compliance requirements.

## Cookie reference

| Cookie                           | Purpose                                                                                                                                                                                                                              | Category   | Expiry                       |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------- | ---------------------------- |
| `c15t-consent`                   | Stores the shopper's consent preferences (necessary, functionality, marketing, measurement) and the timestamp when preferences were last set. Contains only binary accept/decline values per category.                               | Essential  | Persistent (browser-managed) |
| `authjs.anonymous-session-token` | JWT token for anonymous shopper sessions. Carries the anonymous cart ID and guest session data. The `__Secure-` prefix is added automatically on HTTPS.                                                                              | Essential  | Session                      |
| `authjs.session-token`           | JWT token for authenticated shopper sessions, managed by NextAuth. Set when a shopper signs in.                                                                                                                                      | Essential  | Session                      |
| `catalyst.visitorId`             | Unique visitor identifier used for BigCommerce native analytics events (visit started, product viewed). Set at the proxy level on every request, respects the shopper's consent selection.                                           | Analytics  | 400 days                     |
| `catalyst.visitId`               | Session-scoped visit identifier. Every page visit extends/slides the expiration of this cookie an additional 30 minutes.                                                                                                             | Analytics  | 30 minutes (sliding)         |
| `catalyst.productViews`          | The products already reported with a `ProductViewed` event in the current visit, so each product is reported once per visit. Tied to the current `catalyst.visitId` and refreshed with it. Respects the shopper's consent selection. | Analytics  | 30 minutes (sliding)         |
| `currencyCode`                   | The shopper's selected currency. Persists the selection across pages and visits.                                                                                                                                                     | Functional | Session                      |
| `force-refresh`                  | Set when a shopper signs out, so the next page load refreshes client-side state for the signed-out session. Set to `false` once the refresh runs.                                                                                    | Essential  | Session                      |
| `toast-notification`             | Carries a one-time notification message (for example, a success or error message after a form submission) from the server to the next page render.                                                                                   | Essential  | 1 second                     |

## Cookie categories

Categories follow the same taxonomy used by BigCommerce's Script Manager and the Catalyst consent manager:

* **Essential** — Required for core storefront functionality. These cookies are always set and cannot be declined.
* **Functional** — Support shopper preferences such as currency selection. Set when the shopper makes a relevant choice.
* **Analytics** — Used for aggregate analytics on storefront traffic. Subject to the shopper's consent selection when cookie consent is enabled.
* **Marketing** — Used for targeted advertising and campaign tracking. Subject to the shopper's consent selection when cookie consent is enabled.

> **Warning**
>
> These category labels reflect Catalyst's internal taxonomy and are not a legal determination of whether a cookie requires consent under GDPR, CCPA, or any other applicable law. Store owners are responsible for correctly categorizing their own scripts and for verifying that their cookie usage meets the requirements of all relevant regulations. Consult qualified legal counsel if you are unsure how to classify a specific cookie.

## Resources

* [Cookie Consent](/developer/docs/storefront/catalyst/features/cookie-consent)
* [Privacy and Security](/developer/docs/storefront/catalyst/reference/security)