Sign-in session · laabo_access
The API sets this cookie after web sign-in. It is HttpOnly, uses SameSite=Lax, is marked Secure in production, and expires according to the issued access-token lifetime. It lets the browser make authenticated requests without exposing the token to page scripts.

