# Replace cookie

URL: https://docs.hanzo.ai/docs/openapi/team/put-team-account-cookie

> Writes the team session token into the HttpOnly `account-token` cookie — Secure, SameSite=Lax, whole-origin scope, thirty days — and answers {"result": true}.

`PUT /v1/team/account/cookie`

> [Team →](https://docs.hanzo.ai/docs/openapi/team) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides)

|               |                                               |
| ------------- | --------------------------------------------- |
| **Address**   | `https://api.hanzo.ai/v1/team/account/cookie` |
| **Method**    | `PUT`                                         |
| **Operation** | `put_team_account_cookie`                     |
| **Auth**      | `Authorization: Bearer $HANZO_API_KEY`        |

Writes the team session token into the HttpOnly `account-token` cookie — Secure, SameSite=Lax, whole-origin scope, thirty days — and answers {"result": true}. This is how the client turns the token it caught off the OAuth bounce into a credential page JS can no longer read, which IS the security property: script that cannot see the cookie cannot exfiltrate it, and every later call on the files, billing and collaborator planes authenticates from it when no bearer is sent.

The token is VERIFIED — signature and expiry, against this service's own signing secret — BEFORE it is stored. Anything this service did not sign is 401 and nothing is written; persisting a caller-supplied value unchecked would be a session-fixation hole, where an attacker pins a cookie the victim's browser then presents as its own.

The token may arrive as `token` in the JSON body or, when the body is absent or unparseable, from the Authorization bearer — an unreadable body is NOT an error here. The sibling DELETE clears this same cookie and signs the browser out of team only: the IAM cookie set alongside it is a different credential with its own lifetime and is left alone.

## Request

The document declares no body for `PUT /v1/team/account/cookie`. The handler is typed in cloud but its shape is not yet emitted, so the fields are not listed here — ask MCP's `describe` for `put_team_account_cookie`, which answers from the running route.

## Response

| Status | Body      | Meaning |
| ------ | --------- | ------- |
| `2XX`  | cookieAck | Success |

`2XX` body — 1 field.

| Field    | In   | Type    | Always | Description |
| -------- | ---- | ------- | ------ | ----------- |
| `result` | body | boolean | —      |             |

Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors).

## Examples

**CLI**

```bash
hanzo team account cookie replace
```

**SDK**

**.ts**

```ts
import { Configuration, TeamApi } from 'hanzoai';

const api = new TeamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.putTeamAccountCookie();
```

**.py**

```python
from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import TeamApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = TeamApi(client).put_team_account_cookie()
```

**.go**

```go
cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.TeamAPI.PutTeamAccountCookie(context.Background()).Execute()
if err != nil {
	return err
}
```

**.rs**

```rust
use hanzo_client::apis::{configuration::Configuration, team_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = team_api::put_team_account_cookie(&cfg, Default::default()).await?;
```

**.java**

```java
import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.TeamApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new TeamApi(client).putTeamAccountCookie();
```

**HTTP**

```bash
curl -X PUT https://api.hanzo.ai/v1/team/account/cookie \
  -H "Authorization: Bearer $HANZO_API_KEY"
```

**MCP**

MCP reaches **team** through the `team` tool, which names its 33 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them:

```bash
curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "list_team_account_providers"
         }
       }
     }'
```

---

[Team API](https://docs.hanzo.ai/docs/openapi/team) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)