Signing in
Supabase authentication uses cookies with names based on the project identifier, usually starting sb- and containing auth-token. A session can be split across several numbered cookies. They maintain sign-in and refresh authentication. Temporary sign-in/security flows may also use related cookies.
The installed authentication library uses a default cookie lifetime of up to 400 days, refreshed as sessions are maintained. Token validity and server-side session expiry are separate. Sign-out requests removal of the local authentication session.
Your selected workspace
The work_platform_business cookie remembers the workspace selected through the switcher. It contains a workspace identifier, lasts up to one year and does not grant access on its own. The server still verifies membership. Its exemption/consent classification must be confirmed before launch.
Tracking and consent
The reviewed application code does not add advertising pixels or analytics trackers. No optional tracking consent banner has been added. Before deployment, check hosting tools and any later integrations too. Optional technology requiring consent must stay blocked until the appropriate choice is made.
Authentication cookies needed to provide a requested sign-in service are different from optional marketing technology. A decorative Accept all button would not make tracking lawful or complete the privacy work.
Your browser controls
You can remove cookies using your browser settings. Removing sign-in cookies signs you out; removing the workspace cookie forgets that selection. Blocking all cookies may prevent sign-in. A cookie identifier is not a password, but session cookies should still be treated as sensitive.