Cookies

Session

domdoc_session is set when you sign in. It is HttpOnly and SameSite=Lax, and it lasts 30 days. It is the session. JavaScript on the page cannot read it. Secure is set when the API is configured for HTTPS.

Sign out clears it.

Provider sign-in

domdoc_oauth_state is set only while you are sent to Gmail or GitHub. It is HttpOnly, lasts 10 minutes, and is deleted when you return. It matches the sign-in request to the response so another site cannot finish the sign-in for you.

Storage in the browser

The open guest file is kept in IndexedDB under the database name domdoc-guest. It is not a cookie and it is not kept in local storage. The keep-file handoff uses session storage, and only after you choose to keep the file across a provider sign-in.

The SDK docs site can store the colour theme you pick in local storage under the key theme. That value is not sent as an account preference.

Measurement

Google Analytics loads on every page, including the SDK docs. The tag id is G-8GT6Y9JSNK. It can set cookies such as _ga to recognise a browser and count visits. Those cookies are sent to Google. They are separate from the session cookie.

Ads

If the free plan shows an ad, the ad provider may set its own cookies under its policy. The session cookie above is not an advertising cookie. An ad-free plan removes the ad slot.