Session Management - Streamly

Cookies

Cookie	Role
`sb-streamly-viewer-auth-token`	Viewer Supabase session
`sb-streamly-operator-auth-token`	Operator Supabase session
`streamly_viewer_profile`	Active Who’s Watching profile
`streamly-locale`	UI locale

Refresh

Clients call /api/auth/refresh to renew tokens. Keep middleware lean — heavy logic belongs in route handlers (Cloudflare size).

Recommended Supabase Auth settings

Setting	Suggestion
JWT expiry	604800 (7 days)
Inactivity timeout	96h or app idle cookie
Short hard timebox	Avoid for OTT UX

Logout

Viewer/landing logout via /api/landing/logout and standard Supabase sign-out on account surfaces. Operator logout clears the operator cookie scope only.