Cookies — apxlbs

Cookies we set

Name	Type	Set when	Retention
__Host-authjs.session-token (prod) / authjs.session-token (dev)	Strictly necessary	On successful sign-in via magic link	Rolling 30-day max; deleted on sign-out
apxlbs_2fa	Strictly necessary	On successful TOTP / recovery code verification	12 hours
authjs.csrf-token / __Host-authjs.csrf-token	Strictly necessary	On every visit to a sign-in / auth-handler route	Session-bound; deleted on browser close
authjs.callback-url / __Secure-authjs.callback-url	Strictly necessary	When the auth flow begins	Cleared after sign-in completes (max 24h)
_ga / _ga_<measurement-id>	Analytics	Optional, public pages only	Vendor-managed analytics retention; commonly up to 24 months
_clck / _clsk and related clarity.ms storage	Analytics	Optional, public pages only	Vendor-managed analytics retention; commonly session to 12 months
ph_<project-key>_posthog (browser storage)	Analytics	Optional, public pages only	Vendor-managed analytics retention; commonly up to 12 months
apx_ses / apx_vis / apx_attr (browser storage, apxlbs.com homepage)	Analytics	Homepage	Session (apx_ses); up to 90 days (apx_attr); until cleared (apx_vis)
apxlbs.analytics.visitor (browser localStorage)	Analytics	First public page view (first-party)	Persistent until you clear site data
apxlbs.analytics.session (browser sessionStorage)	Analytics	First public page view (first-party)	Cleared when the browser tab closes

Per-cookie purpose

__Host-authjs.session-token (prod) / authjs.session-token (dev)

Authenticated session — maps to a sessions row in our database. Without it you cannot access /admin or /portal.

apxlbs_2fa

Marks the current session as 2FA-verified within the last 12 hours. HMAC-SHA256 signed; user-id bound; cannot be lifted to another session.

authjs.csrf-token / __Host-authjs.csrf-token

Anti-CSRF token used by Auth.js for sign-in/sign-out POST requests.

authjs.callback-url / __Secure-authjs.callback-url

Stores the URL to return to after sign-in completes.

_ga / _ga_<measurement-id>

Google Analytics page-view and funnel measurement. Only set if a Google Analytics measurement ID is configured; disabled for /admin, /api, /sign-in, and browsers with Do Not Track enabled.

_clck / _clsk and related clarity.ms storage

Microsoft Clarity session analytics and heatmap diagnostics. Only set if a Microsoft Clarity project ID is configured; disabled for /admin, /api, /sign-in, and browsers with Do Not Track enabled.

ph_<project-key>_posthog (browser storage)

PostHog product analytics (page views, clicks and funnel steps). Only set if a PostHog project key is configured; disabled for /admin, /api, /sign-in, and browsers with Do Not Track enabled.

apx_ses / apx_vis / apx_attr (browser storage, apxlbs.com homepage)

First-party, random session and visitor ids plus the first ?ref / utm_* a visitor arrived with, used to count visits and attribute applications. Not set for bots or with Do Not Track.

apxlbs.analytics.visitor (browser localStorage)

First-party random visitor identifier for our own page-view counts. Not an HTTP cookie — stored in browser localStorage and never sent as a cookie header. Set on public pages only; disabled for /admin, /api, /sign-in, and browsers with Do Not Track enabled.

apxlbs.analytics.session (browser sessionStorage)

First-party random session identifier for our own page-view counts. Not an HTTP cookie — stored in browser sessionStorage. Set on public pages only; disabled for /admin, /api, /sign-in, and browsers with Do Not Track enabled.

Analytics — Google Analytics and Microsoft Clarity

If configured, Google Analytics and Microsoft Clarity run on public pages only. They are not loaded on /admin, /api, or sign-in surfaces, and are skipped when the browser sends a Do Not Track signal.

What we don't use

Advertising cookies
Behavioral profiling cookies
Third-party social-network cookies (Facebook Pixel, LinkedIn Insight, etc.)
Fingerprinting cookies

How to clear or block

Your browser controls cookie storage. Clearing cookies for apxlbs.com will sign you out of /admin and /portal but has no effect on public marketing pages. Blocking strictly-necessary cookies will prevent sign-in entirely.