> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamly.watch/llms.txt
> Use this file to discover all available pages before exploring further.

# Session Management

> Viewer and operator session cookies, refresh endpoint, and recommended Supabase Auth timeouts for OTT.

## Cookies

| Cookie                            | Role                          |
| --------------------------------- | ----------------------------- |
| `sb-streamly-viewer-auth-token`   | Viewer Supabase session       |
| `sb-streamly-operator-auth-token` | Operator Supabase session     |
| `streamly_viewer_profile`         | Active Who’s Watching profile |
| `streamly-locale`                 | UI locale                     |

## Refresh

Clients call `/api/auth/refresh` to renew tokens. Keep middleware lean — heavy logic belongs in route handlers (Cloudflare size).

## Recommended Supabase Auth settings

| Setting            | Suggestion             |
| ------------------ | ---------------------- |
| JWT expiry         | 604800 (7 days)        |
| Inactivity timeout | 96h or app idle cookie |
| Short hard timebox | Avoid for OTT UX       |

## Logout

Viewer/landing logout via `/api/landing/logout` and standard Supabase sign-out on account surfaces. Operator logout clears the operator cookie scope only.

## Related

* [Authentication Flow](/authentication/authentication-flow)
* [Supabase](/configuration/supabase)
* [Security](/technical/security)