Stripe: Cookie Settings

Preference cookies let us save your preferences and recognize you when you return to our Services.

	Domain	Type	Duration
allow-unsupported-browser Remembers your choice to use an unsupported browser so that we don't keep prompting you to switch to a supported one.	.stripe.com	First party	session
ark_in_cad_opt_out Remembers your choice to temporarily use the old version of the connected account detail page.	.stripe.com	First party	1 week
color-scheme Remembers whether you want a light or dark color scheme in the API reference.	.stripe.com	First party	6 months
disable_cmd_f_override Disables the Cmd/Ctrl + F shortcut in Stripe's API reference. Uses the browser's default behavior instead to search the page.	.stripe.com	First party	6 months
docs.prefs Remembers preferences that you selected in our docs.	.stripe.com	First party	6 months
double_cmd_f_uses Tracks your use of the Cmd/Ctrl + F shortcut in Stripe's API reference. If you already use it or have opted out a certain number of times, we stop suggesting it.	.stripe.com	First party	6 months
expanded-topics Remembers which topics are expanded in Stripe's API reference between page refreshes.	.stripe.com	First party	6 months
has_intentionally_selected_curl Remembers whether you explicitly chose to view docs with curl.	.stripe.com	First party	6 months
lang Remembers which programming language is selected for the code examples in Stripe's docs.	.stripe.com	First party	6 months
payment_methods_settings_platform Remembers the last viewed platform on your payment methods settings page.	.stripe.com	First party	6 months
recent-views Remembers your last few visits to the Stripe docs, including the page and timestamp, to help you pick up where you left off.	.stripe.com	First party	1 year
sca_migration_not_started_alert_actioned Temporarily hides the reminder to update your integration for Strong Customer Authentication.	.stripe.com	First party	7 days
skip_mismatched_country_check Sometimes a user accesses a country-specific version of the docs that doesn't match the location of their IP address. Remembers that you closed the notification in this case so that we don't keep prompting you to switch countries.	.stripe.com	First party	session
skip_tfa_interrupt Remembers your preference to skip two-factor authentication so that we don't show it the next time you log in.	.stripe.com	First party	30 days
*_dismissed Remembers whether you dismissed a notice on support.stripe.com.	support.stripe.com	Local storage	N/A

Advertising cookies and similar technologies on stripe.com allow us to place targeted Stripe advertisements on other sites you visit and measure your engagement with those ads.

	Domain	Type	Duration
_fbp Used for Stripe's marketing teams to optimize advertising on Facebook.	.facebook.com, .stripe.com, .stripe.events, .go.stripe.global	Third party	3 months
_ga Enriches web analytics and form submissions with firmographic data, controlled by a Clearbit script.	.stripe.com, .stripe.events, .go.stripe.global	Third party	1 year
_gcl_au Stores Google Marketing campaign information. Used to determine when you click an ad and later visit the linked site.	.go.stripe.global	Third party	3 months
_guid Created by LinkedIn’s tracking script and used by LinkedIn to provide device characteristics and user activity indicators across page views.	.stripe.com, .linkedin.com, .ads.linkedin.com, .go.stripe.global	Third party	1 day
_mkto_trk Set by our marketing automation platform, Marketo, to track how marketing email recipients use Stripe's websites, measure campaign effectiveness, and show you more relevant content.	.stripecdn.com, .stripe.com, .go.stripe.global	Third party	2 years
aam_uuid Created by LinkedIn’s tracking script and used by LinkedIn to provide device characteristics and user activity indicators across page views.	.stripe.com, .linkedin.com, .ads.linkedin.com, .go.stripe.global	Third party	30 days
AMCV_* Created by LinkedIn’s tracking script and used by LinkedIn to provide device characteristics and user activity indicators across page views.	.stripe.com, .linkedin.com, .ads.linkedin.com, .go.stripe.global	Third party	1 year
bcookie Created by LinkedIn’s tracking script and used by LinkedIn to provide device characteristics and user activity indicators across page views.	.stripe.com, .linkedin.com, .ads.linkedin.com, .go.stripe.global	Third party	2 years
c_user Set by Facebook to provide device characteristics and user activity indicators when visiting stripe.com while logged into Facebook.	.clearbit.com, .facebook.com, .go.stripe.global, .stripe.com, .stripe.events	Third party	1 year
datr Set by Facebook to provide device characteristics and user activity indicators when visiting stripe.com while logged into Facebook.	.facebook.com, .stripe.com, .stripe.events, .go.stripe.global	Third party	2 years
dpr Set by Facebook to provide device characteristics and user activity indicators when visiting stripe.com while logged into Facebook.	.facebook.com, .stripe.com, .stripe.events, .go.stripe.global	Third party	1 week
ev Controls which variant of Stripe sites you see when we’re experimenting with the site's look and feel. This ensures you will get a consistent experience.	.stripe.com	First party	2 months
fr Set by Facebook to provide device characteristics and user activity indicators when visiting stripe.com while logged into Facebook.	.facebook.com, .stripe.com, .stripe.events, .go.stripe.global	Third party	3 months
GPS Used so that other Google properties can show you more relevant ads.	.youtube.com	Third party	30 minutes
IDE Facilitates remarketing on other websites with the DoubleClick ad network.	.doubleclick.net	Third party	2 years
imt Remembers how you entered Stripe's website to help our marketing teams set goals and measure campaign performance.	stripe.com, stripecdn.com	Local storage	N/A
invite Remembers that you signed up via a promotional invitation link so that Stripe applies the relevant discounts even if you don't sign up right away.	.stripe.com	First party	6 months
li_oatml Created by LinkedIn’s tracking script and used by LinkedIn to provide device characteristics and user activity indicators across page views.	.stripe.com, .linkedin.com, .ads.linkedin.com, .go.stripe.global	Third party	1 month
li_sugr Created by LinkedIn’s tracking script and used by LinkedIn to provide device characteristics and user activity indicators across page views.	.stripe.com, .linkedin.com, .ads.linkedin.com, .go.stripe.global	Third party	3 months
liap Created by LinkedIn’s tracking script and used by LinkedIn to provide device characteristics and user activity indicators across page views.	.stripe.com, .linkedin.com, .ads.linkedin.com, .go.stripe.global	Third party	1 year
lidc Created by LinkedIn’s tracking script and used by LinkedIn to remarket website visitors via LinkedIn.	.stripe.com, .linkedin.com, .ads.linkedin.com, .go.stripe.global, .stripe.events	Third party	24 hours
lissc Created by LinkedIn’s tracking script and used by LinkedIn to provide device characteristics and user activity indicators across page views.	.stripe.com, .linkedin.com, .ads.linkedin.com, .go.stripe.global	Third party	6 months
m-ans_frontend_early_version To help us deliver ads, measure their performance, and make them more relevant to you based on criteria like your activity on Quora and visits to our ad partners' websites.	.stripe.com, .go.stripe.global, .stripe.events	Third party	2 years
m-b To help us deliver ads, measure their performance, and make them more relevant to you based on criteria like your activity on Quora and visits to our ad partners' websites.	.stripe.com, .go.stripe.global, .stripe.events	Third party	2 years
m-b_lax To help us deliver ads, measure their performance, and make them more relevant to you based on criteria like your activity on Quora and visits to our ad partners' websites.	.stripe.com, .go.stripe.global, .stripe.events	Third party	2 years
m-b_strict To help us deliver ads, measure their performance, and make them more relevant to you based on criteria like your activity on Quora and visits to our ad partners' websites.	.stripe.com, .go.stripe.global, .stripe.events	Third party	2 years
m-s To help us deliver ads, measure their performance, and make them more relevant to you based on criteria like your activity on Quora and visits to our ad partners' websites.	.stripe.com, .go.stripe.global, .stripe.events	Third party	2 years
m-tz To help us deliver ads, measure their performance, and make them more relevant to you based on criteria like your activity on Quora and visits to our ad partners' websites.	.stripe.com, .go.stripe.global, .stripe.events	Third party	1 year
m-uid To help us deliver ads, measure their performance, and make them more relevant to you based on criteria like your activity on Quora and visits to our ad partners' websites.	.stripe.com, .go.stripe.global, .stripe.events	Third party	22 months
sb Set by Facebook to provide device characteristics and user activity indicators when visiting stripe.com while logged into Facebook.	.facebook.com, .stripe.com, .stripe.events, .go.stripe.global	Third party	2 years
sdsc Set by LinkedIn on the careers pages and is used for the 'Apply with LinkedIn' function.	.stripe.com, .linkedin.com, .ads.linkedin.com, .go.stripe.global	Third party	1 year
spin Set by Facebook to provide device characteristics and user activity indicators when visiting stripe.com while logged into Facebook.	.facebook.com, .stripe.com, .stripe.events, .go.stripe.global	Third party	2 years
spl Session cookie used by splashthat for identification of visitors to event marketing pages that they host.	.stripe.events	Third party	1 year
UserMatchHistory This cookie is used by LinkedIn Ads to help Stripe measure advertising performance.	.stripe.com, .linkedin.com, .ads.linkedin.com, .go.stripe.global	Third party	30 days
VISITOR_INFO1_LIVE Used by YouTube to enable recommendations and analytics. Also used to detect and resolve problems with the service.	.youtube.com	Third party	6 months
wd Set by Facebook to provide device characteristics and user activity indicators when visiting stripe.com while logged into Facebook.	.facebook.com, .stripe.com, .stripe.events, .go.stripe.global	Third party	1 week
xs Set by Facebook to provide device characteristics and user activity indicators when visiting stripe.com while logged into Facebook.	.facebook.com, .stripe.com, .stripe.events, .go.stripe.global	Third party	1 year
YSC Used to keep statistics of what videos you have seen.	.youtube.com	Third party	session
yt-remote-connected-devices Used to store YouTube video player preferences.	youtube.com	Local storage	N/A
yt-remote-device-id Used to store YouTube video player preferences.	youtube.com	Local storage	N/A
yt.innertube::nextId Used by YouTube to queue the next video.	youtube.com	Local storage	N/A
yt.innertube::requests Used to remember which YouTube videos have already been watched.	youtube.com	Local storage	N/A

Analytics cookies help us understand how visitors interact with our Services, allowing us to analyze and improve our Services (also through third party analytics).

	Domain	Type	Duration
__stripe_orig_props Remembers how you got to our website, including the URL you came from and the Stripe page you originally landed on.	.stripe.com	First party	1 year
_gat Automatically created by a Google Analytics script to throttle the request rate to Google Analytics.	.stripe.com, .stripe.events, .go.stripe.global	Third party	1 minute
_gat_stripe_com Automatically created by a Google Analytics script to throttle the request rate to Google Analytics.	.stripe.com, .stripe.events, .go.stripe.global	Third party	1 minute
_gat_UA-12675062-14 Automatically created by a Google Analytics script to throttle the request rate to Google Analytics.		Third party	1 minute
_gat_UA-12675062-5 Automatically created by a Google Analytics script to throttle the request rate to Google Analytics.	.stripe.com	Third party	1 minute
_ga* Automatically created by a Google Analytics script to track a user's page views and clicks with a unique ID, without revealing who you are.	.stripe.com, .stripe.events, .go.stripe.global	Third party	60 days
_gid Automatically created by a Google Analytics script to track a user’s page views and clicks with a unique ID, without revealing who you are.	.stripe.com, .linkedin.com, .ads.linkedin.com, .go.stripe.global	Third party	1 day
atlas_invite Applies relevant promotional incentives if you signed up through an invitation link.	.stripe.com	First party	session
atlas_ref Built to track the origin of an Atlas referral, similar to atlas_invite. Not currently in use.	.stripe.com	First party	24 hours
cid Tracks browsing activity across the site within a given browser session.	.stripe.com	First party	session
eid Used for A/B testing Stripe Checkout features. Remembers which experiment you're in.	.checkout.stripe.com	First party	2 months
gh_src Measures the effectiveness of our job listings outside of Stripe's websites.	.stripe.com	First party	2 years
lsid Serves as a fallback for the cid cookie.	stripe.com	Local storage	N/A
merchant To prevent fraud, enables Stripe to determine the merchant ID in the Stripe Dashboard.	.stripe.com	First party	session
personalizations For new features and A/B testing, remembers which version of the docs you're in so that we show you the right UI and features.	support.stripe.com	Local storage	N/A
site_sid Anonymously provides device characteristics and user activity indicators across stripe.com to help us improve our site.	.stripe.com	First party	2 hours
user To prevent fraud, enables Stripe to determine the user in the Stripe Dashboard.	.stripe.com	First party	session

Authentication cookies enable Stripe to remember you so you don’t have to log in as you use our Services.

Required

	Domain	Type	Duration
_forum_session Lets you access the Stripe Atlas Community forum.	.discuss.stripe.community	Third party	session
_t Lets you access the Stripe Atlas Community forum.	.discuss.stripe.community	Third party	2 months
apps_oauth_state Used to enable some OAuth workflows in the Dashboard.	dashboard.stripe.com	Local storage	N/A
cliauth_secret Lets you log in to the Stripe CLI with your Stripe account from the command line.	.stripe.com	First party	session
link.auth_session_client_secret Provide a logged-in experience when a consumer uses Stripe Payment Element to make purchases.	js.stripe.com	Local storage	N/A
lsession Enables authentication for Stripe's Express signup and Dashboard pages.	.stripe.com	First party	1 year
pay_sid Stores consumer credentials such that users can stay logged in at Link Marketing, Support and Web App sites. Additionally it provides a one click payment experience at Checkout.	.checkout.stripe.com, .edge-checkout.stripe.com	First party	90 days
saml_sca_success_for_* Ensures that you've re-authenticated before performing sensitive actions in the Stripe Dashboard, as defined by SCA regulations.	.stripe.com	First party	30 seconds
samlit_email Identifies your email during SSO session authentication for restricted actions.	.stripe.com	First party	16 minutes
samlit_token Indicates when two-factor authentication is required, for SCA compliance.	.stripe.com	First party	16 minutes
site-auth Remembers whether you're logged in to the Stripe Dashboard.	.stripe.com	First party	session

Fraud prevention cookies, and similar technologies that we deploy through our Site, help us learn things about computers and web browsers used to access Stripe Services. This information helps us monitor for and detect potentially harmful or illegal use of our Services.

Required

	Domain	Type	Duration
__stripe_mid Set for fraud prevention purposes and helps us assess the risk associated with an attempted transaction. Learn more about advanced fraud detection.	.checkout.stripe.com, request	First party	1 year
__stripe_sid Set for fraud prevention purposes and helps us assess the risk associated with an attempted transaction. Learn more about advanced fraud detection.	.checkout.stripe.com, request	First party	30 minutes
_GRECAPTCHA reCAPTCHA sets a necessary cookie when executed for the purpose of providing its risk analysis.	.stripe.com	Third party	6 months
m For fraud detection. Helps Stripe assess the risk associated with an attempted transaction on the your website. Read more about advanced fraud detection.	.m.stripe.com	First party	2 years
machine_identifier To prevent fraud, enables Stripe to determine the computer being used on the Stripe Dashboard.	.stripe.com	First party	5 years
ndcd Set by Mastercard when the Stripe ACS is used to authenticate 3D-Secure payments. This cookie facilitates device detection in order to enhance fraud detection and prevention as well as to identify suspicious devices or devices that are behaving abnormally.	.acs.touch.tech, .idcheck.acs.touchtechpayments.com, .verifiedbyvisa.acs.touchtechpayments.com	Third party	1 year
private_machine_identifier Identifies the computer across login sessions and users to prevent fraud.	.stripe.com	First party	1 year

Functionality cookies are used to keep our Site and Services working correctly, like showing you the right information for your selected location.

Required

	Domain	Type	Duration
__Host-saml_auth_result Stores details about the most recent single sign-on based login, such as timestamp, and status, which are used to detect when a the saml re-authentication flow succeeds.	dashboard.stripe.com	First party	60 seconds
connect_locale Remembers your language preference from Connect signup and Dashboard pages so that you can read site content in your selected language.	.connect.stripe.com, .express.stripe.com	First party	session
cookie-perms Stores a user's cookie permissions.	.stripe.com, .stripe.dev, .go.stripe.global, .increment.com	First party	6 months
country Ensures you see the correct content (like product offerings) on stripe.com for the country you're in.	.stripe.com	First party	session
docs Remembers the state of elements in docs between sessions. (IndexedDB)	.stripe.com	Local storage	N/A
locale Controls the language on stripe.com to deliver a reading experience in the language you expect.	.stripe.com	First party	session
saml_login_result Stores details about the most recent SAML integration test, i.e., test results, status, and test request ID, which are used to display saml configuration problems.	.stripe.com	First party	session
scfc Fixes bugs on our website in certain situations by forcing the browser cache to clear.	.stripe.com	First party	1 year
twilio_chat_* Local storage items that store copilot chat state.	dashboard.stripe.com	Local storage	N/A

Security cookies enable us to protect user data from unauthorized access.

Required

	Domain	Type	Duration
__Host-session Determines your identity when authenticating to the Stripe Dashboard (so that you can log in to the right account).	support.stripe.com, stripe.com, dashboard.stripe.com, connect.stripe.com, express.stripe.com, marketplace.stripe.com, manage.stripe.com, billing.stripe.com, pay.stripe.com	First party	90 days
__Host-stripe.link_app.csrf Prevents attackers from making requests that change user data to Link from other websites.		First party	session
__Host-stripe.link_support_site.csrf Prevents attackers from making requests that change user data to Stripe from other websites.		First party	session
__Host-stripe.sources_redirect_site.csrf Prevents attackers from making requests that change user data to Stripe from other websites.	hooks.stripe.com	First party	session
__Host-stripe.support_site.csrf Prevents attackers from making requests that change user data to Stripe from other websites.	support.stripe.com	First party	session
act_token Stores the account confirmation email’s secret token.	.stripe.com	First party	session
art_token Stores the account confirmation email’s secret token.	.stripe.com	First party	session
cbt_token When a user is confirming a bank account change, via an email link, we set this cookie to the secret token given in the email. This avoids us keeping the secret token in the url as the user moves through the process.	.stripe.com	First party	session
cct_token Stores the account confirmation email’s secret token.	.stripe.com	First party	session
cdt_token Stores the account confirmation email’s secret token.	.stripe.com	First party	session
ect_token Stores the account confirmation email’s secret token.	.stripe.com	First party	session
handoff Determines your identity when authenticating to the Stripe Dashboard on stripe.com domains (so that you can log in to the right account).	.stripe.com	First party	25 hours
lc_token Stores the account confirmation email’s secret token.	.stripe.com	First party	session
prt_token Stores the account confirmation email’s secret token.	.stripe.com	First party	session
session Determines your identity when authenticating to the Stripe Dashboard (so that you can log in to the right account).	.stripe.com	First party	90 days
stripe.appmarketplace.csrf Prevents attackers from making requests that change user data to Stripe from other websites.	marketplace.stripe.com	First party	session
stripe.climate.csrf Prevents attackers from making requests that change user data to Stripe from other websites.	climate.stripe.com	First party	session
stripe.csrf Prevents attackers from making requests that change user data to Stripe from other websites.	.stripe.com	First party	session
stripe.customerportal.csrf Prevents attackers from making requests that change user data to Stripe from other websites.	billing.stripe.com	First party	session
stripe.delegated-authentication.csrf Prevents attackers from making requests that create multiple objects in our backend.	delegated-authentication.stripe.com	First party	30 minutes
stripe.docs.csrf Prevents attackers from making requests that change user data to Stripe from other websites.	stripe.com	First party	session
stripe.idprod.csrf Prevents attackers from making requests that change user data to Stripe from other websites.	verify.stripe.com, qa-verify.stripe.com	First party	session
svt_token Securely stores the support token confirmation email's secret token.	.stripe.com	First party	session

We work with third-party providers like Facebook, Google, and LinkedIn, who also set cookies for analytics and marketing purposes. This list may not be exhaustive, but we commit to keeping it updated based on information from these providers. Please see the following resources for more detailed information about the cookies set by Facebook, Google, and LinkedIn:

Products

Use cases

Payments

Business operations

Get started

Guides

Get started

Guides

Cookie settings

Preferences

Advertising

Analytics

Authentication

Fraud prevention

Functionality

Security

Third-party providers