2026-07-27 — Encrypted session cookie cache
Session data cached in cookies is now encrypted instead of only signed.
Encrypted session cookie cache
When you stay signed in, the API may cache a short-lived copy of your session in a cookie so it does not hit the database on every request.
That cookie is now encrypted. Previously it was signed but still readable if intercepted. Encryption keeps the cached payload private while the signature still blocks tampering.
No change to how you sign in or call the API. After the next deploy, clients pick up the new cookie format automatically as sessions refresh.