---
id: api/commands/setcookie
title: cy.setCookie()
description: Set a browser cookie in Cypress.
section: api
source_path: docs/api/commands/setcookie.mdx
version: fbc9225067c51c52ee13224e3b702cf8a025ec12
updated_at: '2026-08-14T12:36:26.878Z'
---
# setCookie

Set a browser cookie.

## Syntax

```
cy.setCookie(name, value)cy.setCookie(name, value, options)
```

### Usage

**Correct Usage**

```
cy.setCookie('auth_key', '123key') // Set the 'auth_key' cookie to '123key'
```

### Arguments

**name _(String)_**

The name of the cookie to set.

**value _(String)_**

The value of the cookie to set.

**options _(Object)_**

Pass in an options object to change the default behavior of `cy.setCookie()`.

| Option | Default | Description |
| --- | --- | --- |
| `log` | `true` | Displays the command in the [Command log](/llm/markdown/app/core-concepts/open-mode.md#Command-Log) |
| `domain` | Hostname of the current URL | The domain the cookie is visible to. By default the resulting cookie is **not** host-only; it is matched for this host _and all of its subdomains_. To restrict the cookie to a single exact host, pass `hostOnly: true`. See [Cookie scope](#Cookie-scope-host-only-vs-domain-cookies). |
| `expiry` | 20 years into the future | When the cookie expires, specified in seconds since [Unix Epoch](https://en.wikipedia.org/wiki/Unix_time). |
| `hostOnly` | `false` | Whether the cookie is a host-only cookie. When `true`, the cookie is scoped to one exact host (the request's host must exactly match the cookie's domain) and is not attached to requests for sibling or parent hosts. See [Cookie scope](#Cookie-scope-host-only-vs-domain-cookies). |
| `httpOnly` | `false` | Whether the cookie is an HTTP only cookie |
| `path` | `/` | The cookie path |
| `secure` | `false` | Whether the cookie is a secure cookie |
| `timeout` | [`responseTimeout`](/llm/markdown/app/references/configuration.md#Timeouts) | Time to wait for `cy.setCookie()` to resolve before [timing out](#Timeouts) |
| `sameSite` | `undefined` | Cookie's SameSite value. If set, should be one of `lax`, `strict`, or `no_restriction`. Pass `undefined` to use the browser's default. Note: `no_restriction` can only be used if the `secure` flag is set to `true`. |

### Yields

`cy.setCookie()` yields a cookie object with the following properties:

*   `domain`
*   `expiry` _(if specified)_
*   `hostOnly` _(if specified)_
*   `httpOnly`
*   `name`
*   `path`
*   `sameSite` _(if specified)_
*   `secure`
*   `value`

## Examples

### Name Value

#### Set a cookie

```
cy.getCookies().should('be.empty')cy.setCookie('session_id', '189jd09sufh33aaiidhf99d09')cy.getCookie('session_id').should(  'have.property',  'value',  '189jd09sufh33aaiidhf99d09')
```

### Cookie scope (host-only vs. domain cookies)

When you call `cy.setCookie()` without `hostOnly`, the `domain` defaults to the hostname of the current URL, but the cookie is stored as a **domain cookie**, not a host-only cookie. Internally Cypress rewrites the domain to its leading-dot form (e.g. `.app.example.com`), mirroring how real browsers store a cookie that omits the `Domain` attribute's host-only flag. As a result the cookie matches that host **and all of its subdomains**.

This matters for [`cy.request()`](/llm/markdown/api/commands/request.md#Cookies), which pulls matching cookies from the cookie jar by domain match before sending a request. Because the default cookie is a domain cookie, it can be attached to a `cy.request()` aimed at a _different_ host that domain-matches it, for example a sibling host on the same registrable domain. This is working as designed, but can be surprising when you set a convenience cookie for your app and see it appear on an unrelated request.

```
cy.visit('https://app.example.com')// Default: domain cookie, matches app.example.com AND its subdomainscy.setCookie('cookieconsent_status', 'dismiss')// Host-only: matches ONLY the exact host it was set oncy.setCookie('cookieconsent_status', 'dismiss', { hostOnly: true })
```

If a cookie is unexpectedly attached to a `cy.request()` for another host on the same registrable domain, set `hostOnly: true` to keep it scoped to a single exact host.

### Preserving a cookie across tests

By default, Cypress [clears all cookies before each test](/llm/markdown/app/core-concepts/test-isolation.md) to keep tests independent. If you have a known cookie value that every test requires — such as a cookie-consent acceptance or a feature flag — re-set it in a `beforeEach` hook so it is present at the start of every test:

```
// cypress/support/e2e.jsbeforeEach(() => {  cy.setCookie('cookieConsent', 'accepted')})
```

For cookies that are generated by the server after a login flow, use [`cy.session()`](/llm/markdown/api/commands/session.md) instead, which caches and restores the full browser context (cookies, localStorage, and sessionStorage) across tests.

## Rules

### Requirements

*   `cy.setCookie()` requires being chained off of `cy`.

### Assertions

*   `cy.setCookie()` will only run assertions you have chained once, and will not [retry](/llm/markdown/app/core-concepts/retry-ability.md).

### Timeouts

*   `cy.setCookie()` should never time out.

Because `cy.setCookie()` is asynchronous it is technically possible for there to be a timeout while talking to the internal Cypress automation APIs. But for practical purposes it should never happen.

## Command Log

**_Set a cookie on the browser for testing_**

```
cy.getCookies().should('be.empty')cy.setCookie('fakeCookie1', '123ABC')cy.getCookie('fakeCookie1').should('have.property', 'value', '123ABC')
```

The commands above will display in the Command Log as:

When clicking on `setCookie` within the command log, the console outputs the following:

## History

| Version | Changes |
| --- | --- |
| [12.7.0](/llm/markdown/app/references/changelog.md#12-7-0) | Support `hostOnly` option for a given domain. |
| [5.0.0](/llm/markdown/app/references/changelog.md#5-0-0) | Removed `experimentalGetCookiesSameSite` and made `sameSite` property always available. |
| [4.3.0](/llm/markdown/app/references/changelog.md#4-3-0) | Added `sameSite` property when the [experimentalGetCookiesSameSite](/llm/markdown/app/references/configuration.md#Experiments) configuration value is `true`. |
| [0.16.0](/llm/markdown/app/references/changelog.md#0-16-0) | `cy.setCookie()` command added |

## See also

*   [`cy.clearCookie()`](/llm/markdown/api/commands/clearcookie.md)
*   [`cy.clearCookies()`](/llm/markdown/api/commands/clearcookies.md)
*   [`cy.getCookie()`](/llm/markdown/api/commands/getcookie.md)
*   [`cy.getCookies()`](/llm/markdown/api/commands/getcookies.md)
*   [`Cypress.Cookies.debug()`](/llm/markdown/api/cypress-api/cookies.md)