> This page is for Developer. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.bigcommerce.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server. # Cookies > The first-party cookies Catalyst and Stencil storefronts set on the storefront domain by default, with their purpose, consent category, and expiry. BigCommerce storefronts set first-party cookies on the storefront domain by default. The cookies differ between Catalyst and Stencil storefronts, so each is documented in its own section below. Additional cookies may be introduced by scripts configured in Script Manager, subject to each shopper's consent choices. > **Warning** > > This page describes the default cookie behavior of Catalyst and Stencil storefronts. It is not legal advice. Store owners are solely responsible for ensuring their storefront's use of cookies complies with all applicable privacy laws in the jurisdictions where they operate. We recommend consulting qualified legal counsel to assess your specific compliance requirements. ## Catalyst cookies Catalyst sets no third-party cookies itself. | Cookie | Purpose | Category | Expiry | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------- | ---------------------------- | | `c15t-consent` | Stores the shopper's consent preferences (necessary, functionality, marketing, measurement) and the timestamp when preferences were last set. Contains only binary accept/decline values per category. | Essential | Persistent (browser-managed) | | `authjs.anonymous-session-token` | JWT token for anonymous shopper sessions. Carries the anonymous cart ID and guest session data. The `__Secure-` prefix is added automatically on HTTPS. | Essential | Session | | `authjs.session-token` | JWT token for authenticated shopper sessions, managed by NextAuth. Set when a shopper signs in. | Essential | Session | | `catalyst.visitorId` | Unique visitor identifier used for BigCommerce native analytics events (visit started, product viewed). Set at the proxy level on every request, respects the shopper's consent selection. | Analytics | 400 days | | `catalyst.visitId` | Session-scoped visit identifier. Every page visit extends/slides the expiration of this cookie an additional 30 minutes. | Analytics | 30 minutes (sliding) | | `catalyst.productViews` | The products already reported with a `ProductViewed` event in the current visit, so each product is reported once per visit. Tied to the current `catalyst.visitId` and refreshed with it. Respects the shopper's consent selection. | Analytics | 30 minutes (sliding) | | `currencyCode` | The shopper's selected currency. Persists the selection across pages and visits. | Functional | Session | | `force-refresh` | Set when a shopper signs out, so the next page load refreshes client-side state for the signed-out session. Set to `false` once the refresh runs. | Essential | Session | | `toast-notification` | Carries a one-time notification message (for example, a success or error message after a form submission) from the server to the next page render. | Essential | 1 second | ## Stencil cookies Stencil storefronts set the following cookie as a bot-detection signal. | Cookie | Purpose | Category | Expiry | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | --------- | ------------------------------------ | | `SHOP_RENDER_VERIFICATION_TOKEN` | Server-signed token used as a bot-detection signal. Confirms the browser executed client-side JavaScript. Contains no personal data. | Essential | 15 minutes (fixed, does not refresh) | ## Cookie categories Categories follow the same taxonomy used by BigCommerce's Script Manager and the Catalyst consent manager. Both sections above use them: * **Essential** — Required for core storefront functionality. These cookies are always set and cannot be declined. * **Functional** — Support shopper preferences such as currency selection. Set when the shopper makes a relevant choice. * **Analytics** — Used for aggregate analytics on storefront traffic. Subject to the shopper's consent selection when cookie consent is enabled. * **Marketing** — Used for targeted advertising and campaign tracking. Subject to the shopper's consent selection when cookie consent is enabled. > **Warning** > > These category labels reflect Catalyst's internal taxonomy and are not a legal determination of whether a cookie requires consent under GDPR, CCPA, or any other applicable law. Store owners are responsible for correctly categorizing their own scripts and for verifying that their cookie usage meets the requirements of all relevant regulations. Consult qualified legal counsel if you are unsure how to classify a specific cookie. ## Resources * [Catalyst Cookie Consent](/developer/docs/storefront/privacy/cookie-consent) * [Privacy and Security](/developer/docs/storefront/catalyst/reference/security)