Type Alias CookieMethodsServer

If set to tokens-only, only the user's access and refresh tokens will be encoded in cookies. The user object will be encoded in memory if the userStorage option is not provided when creating the client. Unset value defaults to user-and-tokens.

You should keep this option the same between createBrowserClient() and createServerClient(). When set to tokens-only accessing the user property on the data returned from getSession() will not be possible. Use getUser() or preferably getClaims() instead.

Called by the Supabase Client to write cookies to the response after a token refresh or auth state change.

IMPORTANT: Call await supabase.auth.getClaims() (or getSession()/ getUser()) early in your request handler — before any response is generated. If a token refresh completes after the HTTP response has already been committed, the updated session cannot be written here and will be lost, causing the next request to refresh again.

CDN and reverse proxy caching.

Token refreshes write Set-Cookie headers to the response. If your app is behind a CDN or reverse proxy (e.g. CloudFront, Vercel Edge, Cloudflare), set Cache-Control: private, no-store on routes that handle authentication (typically your middleware) to prevent these responses from being cached.

See the official server-side rendering guides for guidance on choosing between getSession(), getUser(), and getClaims().