--- title: Set Persistent Cookie node description: Configure the Set Persistent Cookie node to create a signed and encrypted persistent JWT cookie on the client after successful PingAM authentication. component: platform version: 7.5 page_id: platform:auth-node-ref:set-persistent-cookie canonical_url: https://docs.pingidentity.com/platform/7.5/auth-node-ref/set-persistent-cookie.html llms_txt: https://docs.pingidentity.com/platform/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md keywords: ["Nodes & Trees", "Journeys", "Authentication", "HMAC"] page_aliases: ["auth-node-set-persistent-cookie.adoc"] section_ids: availability: Availability inputs: Inputs dependencies: Dependencies configuration: Configuration outputs: Outputs outcomes: Outcomes errors: Errors example: Example --- # Set Persistent Cookie node The Set Persistent Cookie node creates the specified persistent cookie on successful authentication. The default persistent cookie is `session-jwt`. The cookie contains a JWT with a JSON payload including information such as the UID of the identity, and the client IP address. The node encrypts the payload of the JWT using the key pair defined in the active secret mapped to the `am.authentication.nodes.persistentcookie.encryption` secret label. If there isn't a valid secret label mapping in a secret store, AM uses the key pair specified in Realms > *Realm Name* > Authentication > Settings > Security > Persistent Cookie Encryption Certificate Alias. The global setting is found under Configure > Authentication > Core Attributes > Security. The node signs the cookie with the HMAC signing key defined in the node properties or the secret store with the mapped secret label. Configure nodes that read the persistent cookie, for example [Persistent Cookie Decision node](persistent-cookie-decision.html), with the same HMAC signing key. ## Availability | Product | Available? | | ------------------------------------- | ---------- | | PingOne Advanced Identity Cloud | Yes | | PingAM (self-managed) | Yes | | Ping Identity Platform (self-managed) | Yes | ## Inputs When the authentication tree completes successfully, the `CreatePersistentCookieTreeHook` treehook for this node uses session properties to create the persistent cookie. ## Dependencies Make sure the user can successfully authenticate and get a session. If the `noSession` query parameter is used during authentication, the journey will fail. Additonally, you must configure a secret store to store the dynamic secret label mapping to the cookie's signing key. ## Configuration | Property | Usage | | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Idle Timeout | The maximum amount of idle time allowed before the persistent cookie is invalidated, in hours. If no requests are received before the timeout, the cookie is no longer valid. | | Max life | The length of time the persistent cookie remains valid, in hours. After this time has passed, the cookie is no longer valid. | | Use Secure Cookie | When enabled, adds the `Secure` flag to the persistent cookie.If the `Secure` flag is included, the cookie can only be transferred over HTTPS. When a request is made over HTTP, the cookie is not made available to the application. | | Use HTTP Only Cookie | When enabled, adds the `HttpOnly` flag to the persistent cookie.When the `HttpOnly` flag is included, that cookie will not be accessible through JavaScript. According to [RFC 6265](https://www.rfc-editor.org/rfc/rfc6265.html#section-4.1.2.6), the `HttpOnly` flag, "instructs the user agent to omit the cookie when providing access to cookies via 'non-HTTP' APIs (for example, a web browser API that exposes cookies to scripts)." | | HMAC Signing Key | A key to use for HMAC signing of the persistent cookie. This property is deprecated. Use the HMAC Signing Key Secret Label Identifier instead. If you set an HMAC Signing Key Secret Label Identifier, this signing key is ignored.Values must be base64-encoded and at least 256 bits (32 bytes) long.To generate an HMAC signing key, run one of the following commands:```bash $ openssl rand -base64 32 ```or```bash $ cat /dev/urandom | LC_ALL=C tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1|base64 ``` | | HMAC Signing Key Secret Label Identifier | An identifier used to create a *secret label* for mapping to a secret in a secret store.Ping Identity Platform uses this identifier to create a specific secret label for the signing key for this node. The secret label takes the form `am.authentication.nodes.persistentcookie.identifier.signing` where identifier is the value of HMAC Signing Key Secret Label Identifier. The identifier can only contain alphanumeric characters `a-z`, `A-Z`, `0-9`, and periods (`.`). It can't start or end with a period.If you set an HMAC Signing Key Secret Label Identifier and Ping Identity Platform finds a matching secret in a secret store, the HMAC Signing Key is ignored.If HMAC Signing Key is empty, Ping Identity Platform uses the value configured for `am.default.authentication.nodes.persistentcookie.signing` for the realm, or at the global level if undefined.For greater security, you should [rotate signing keys](https://docs.pingidentity.com/pingam/7.5/security/secret-mapping.html) periodically. When you rotate a key, update the corresponding mapping in the realm secret store configuration to reflect this identifier. To read the persistent cookies this node generates, ensure the nodes use the same HMAC signing key. | | Persistent Cookie Name | The name used for the persistent cookie. | ## Outputs The node stores the cookie name in the session properties. The node adds the `CreatePersistentCookieTreeHook` treehook, which runs when the tree completes. ## Outcomes Single outcome path. ## Errors The node logs the following warning messages: * `Unable to create signing key from provided configuration.` The node logs the following error messages: * `Tree hook creation exception` * `No signing keys available to sign JWT` * `Error creating jwt string` ## Example Refer to the [Persistent Cookie Decision node](persistent-cookie-decision.html) example.