# Should I shorten cookie Max-Age?

> Usually no. Max-Age only controls how long the browser keeps the session cookie, not how long tokens are valid. When a shorter Max-Age is useful, and how to set it with @supabase/ssr.

Source: https://supahost.app/kb/cookie-max-age · Updated 2026-11-11

Usually no. The cookie's `Max-Age` only decides how long the browser keeps the session cookie. It doesn't decide how long the access token works (that's the access token lifetime), and it doesn't revoke anything on the server. `@supabase/ssr` uses a long `Max-Age`, 400 days, so the refresh token survives between visits. Shorten it only if you want people to be signed out after a period without visiting.

## What each lifetime controls

| Setting | What it controls | Where it's set |
|---|---|---|
| Access token lifetime | How long one access token is accepted (default one hour) | Your project's Auth settings |
| Refresh token | Lets the client get new access tokens; valid until it's used, revoked or the user signs out | Auth |
| Cookie `Max-Age` | How long the browser keeps the cookies that hold both tokens | Your app's `@supabase/ssr` options |

The cookies are written again every time the session refreshes, which is roughly once per access token lifetime while the user is active. A shorter `Max-Age` therefore works as an inactivity timeout: someone who keeps using the app stays signed in, and someone who doesn't come back within the window starts signed out.

## When a shorter Max-Age makes sense

- An app used on shared or office computers, such as a front-desk bookings screen or an invoicing tool.
- A policy that says sessions end after N hours or days of inactivity.

It's a browser-side measure only. If someone copied the refresh token, it stays valid on the server. To really end sessions, call `supabase.auth.signOut({ scope: "global" })` or have an admin sign the user out.

## How to set it

Pass the same `cookieOptions` to the browser client, the server client and the proxy, or the next write will put the old value back:

```ts
const cookieOptions = { maxAge: 60 * 60 * 8 }; // 8 hours without a visit

// Browser
createBrowserClient(process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!, {
  cookieOptions,
});

// Server and proxy
createServerClient(process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!, {
  cookieOptions,
  cookies: { getAll, setAll },
});
```

Keep `Max-Age` longer than the access token lifetime. Otherwise active users lose the cookie between refreshes and get signed out mid-session.

## On SupaHost

- The access token lifetime is on Dashboard → your project → **Auth** tab → **Sign-in & security** → **Access token lifetime** (300 to 604,800 seconds).
- There's no session time-box or inactivity setting on the Auth tab, so a cookie `Max-Age` plus explicit sign-outs is the practical way to end idle sessions.

## Related

- [Sessions, JWTs and refresh tokens](/docs/auth/sessions)
- [Can auth cookies be HttpOnly?](/kb/httponly-cookies)
- [Server-side auth and SSR](/docs/auth/server-side)
- [JWT expired](/kb/jwt-expired)