# What are ct.client_id and ct.user_token cookies and how long do they live?

Asked by Stefan Weber on 2025-05-28. Tags: nextjs, cookies, privacy.

I am auditing all cookies on our Next.js site ahead of an internal privacy
review and found two set by the Croct proxy: `ct.client_id` and
`ct.user_token`. Our consent banner vendor requires formal documentation for
every cookie: name, purpose, and exact duration.

Can someone confirm the lifetimes and what each cookie is for? I also saw a
`ct.preview_token` mentioned somewhere but it does not appear on our production
domain. And is the duration configurable in case our policy requires shorter
retention?

## 1 answer

### Accepted answer from pieter_dev (2025-05-28)

Documented this exact table for a client review a while back:

- `ct.client_id`: anonymous client identification. Lifetime 1 year.
- `ct.user_token`: the user token for the current visitor. Lifetime 7 days.
- `ct.preview_token`: only exists while someone is viewing a preview link,
  which is why you never see it in production traffic. You can list it as
  session-scoped preview functionality.

All of it is configurable. The SDK cookie options let you set `name`,
`maxAge`, `domain`, `path`, `secure`, and `sameSite` per cookie, so if your
policy mandates shorter retention you can lower the maxAge values. The
`domain` option is also how you share identity across subdomains if you ever
need `app.example.com` and `www.example.com` to see the same visitor.

Worth noting for the review: these are first-party cookies set by your own
proxy, not third-party trackers, which usually puts them in a friendlier
category with consent vendors.