Cookies

What we set

epic-os-session: httpOnly, Secure on HTTPS, SameSite=Lax. Holds a random token. Lasts 30 days or until you sign out.

epic-os-oauth: short-lived state for the GitHub OAuth round-trip (10 minutes). Then it is deleted.

This shell does not set advertising cookies. Cloudflare may set cookies or equivalent on the edge for security and performance.

Control

Sign out clears the session cookie. You can also clear site data in the browser. The product cannot stay signed in without the session cookie.