Kept in this browser only (localStorage). Your cookie is sent as
x-dupr-cookie and used just for your requests — leave it empty to fall back to the cookie
the server is configured with. The API key can also be supplied once in the URL:
?key=… (or ?token=…); it is saved locally and then removed from the
address bar.
Cookies — server default or your own
By default every request uses the cookie the server is configured with.
If that one is missing or expired, paste your own __Host-dupr_at=eyJ… (or just the
JWT) into the field above. It is kept in this browser's
localStorage, sent as the x-dupr-cookie header, and used only for your
requests — nothing is stored server-side. Press Test cookie to check whichever one
is in play; clear the field to fall back to the server default.
- Sign in at
https://dashboard.dupr.com, open DevTools → Application → Cookies.
- Copy the two
__Host- cookies whose domain is api.dupr.com:
__Host-dupr_at (JWT access token — the important one) and __Host-dupr_rt (refresh token).
- Server-side default: paste them as one line into
tools/dupr/cookie.txt (git-ignored) —
__Host-dupr_at=eyJ…; __Host-dupr_rt=eyJ… — or set DUPR_COOKIE, then restart npm run dupr.
Analytics/payment cookies (_ga, _fbp, __stripe_*,
ab.storage.*, media/Facebook cookies…) are ignored. The access token lasts ~30 days; when DUPR
rejects it, copy a fresh one.