- Authentication and session cookies
- next-auth.session-token (with a __Secure- prefix over HTTPS) keeps your account signed in for up to 30 days, renewed during active use. next-auth.csrf-token and next-auth.callback-url support secure sign-in and return navigation; these are session cookies. Sign-out clears the session token.
- HMRC OAuth state cookie
- hmrc_oauth_state, hmrc_oauth_client_id and hmrc_oauth_return link an authorised HMRC connection to the initiating account. They expire after 10 minutes or are cleared when the flow finishes.
- Integration OAuth state cookies
- integration_oauth_state_[provider] and spreadsheet_google_drive_oauth_state protect optional connection callbacks. They expire after 10 minutes or are cleared when the connection finishes.
- MFA and step-up state
- Recent verification details are held in your authenticated session to support protected actions. There is no separate advertising or tracking cookie for MFA.
- hmrc_device_id
- A randomly generated device identifier for HMRC fraud-prevention requests. When you enter an HMRC account workflow, QuarterLink stores the same identifier in a cookie and this browser's local storage. The cookie expires one year after it is written; an unchanged cookie is not renewed. The local storage value has no automatic expiry and can restore the same identifier when the cookie expires or is removed. A valid existing cookie is preserved. Browser settings, private browsing, clearing site data or storage eviction may prevent continuity.
- hmrc_browser_fph
- Stores browser user agent, screen dimensions, colour depth, window size and time-zone offset for HMRC fraud-prevention requests. Written when you enter an HMRC account workflow if the stored value is absent or has changed, and expires one day after the last write. The values are checked again during the workflow, including after resizing; an unchanged value does not extend the expiry. It is not created or refreshed on public sales or legal pages.
- HMRC sync recovery session storage
- Stores a random request reference, a workspace selector, the selected client or income-source types and the last known status in this tab. This helps recover a saved sync after a reload or lost response. It does not store tax records, HMRC tokens or MFA details. After 24 hours, unresolved references remain for recovery and to prevent accidental duplicate requests. Your browser manages this session storage, and you can clear it through its site-data settings.
- cookie-consent localStorage value
- Remembers that you acknowledged this notice. It has no automatic expiry and stays in this browser until you clear site storage.
- Workspace preferences
- preferredViewMode and relevant workflow preference storage remember choices you make inside the account workspace. Local storage remains until you clear it; workflow preferences can be renewed when you change them.
- Stripe hosted-flow cookies
- Stripe may set cookies for checkout, customer portal, invoice payment, fraud prevention, and payment security on Stripe-hosted pages.
