Title: wp_generate_auth_cookie
Published: April 25, 2014
Last modified: August 20, 2026

---

# wp_generate_auth_cookie( int $user_id, int $expiration, string $scheme = ‘auth’, string $token = ” ): string

## In this article

 * [Parameters](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#parameters)
 * [Return](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#return)
 * [Source](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#source)
 * [Hooks](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#hooks)
 * [Related](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#changelog)

[ Back to top](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#wp--skip-link--target)

Generates authentication cookie contents.

## 󠀁[Parameters](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#parameters)󠁿

 `$user_id`intrequired

User ID.

`$expiration`intrequired

The time the cookie expires as a UNIX timestamp.

`$scheme`stringoptional

The cookie scheme to use: `'auth'`, `'secure_auth'`, or `'logged_in'`.
 Default `'
auth'`.

Default:`'auth'`

`$token`stringoptional

User’s session token to use for this cookie.

Default:`''`

## 󠀁[Return](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#return)󠁿

 string Authentication cookie contents. Empty string if user does not exist.

## 󠀁[Source](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#source)󠁿

    ```php
    function wp_generate_auth_cookie( $user_id, $expiration, $scheme = 'auth', $token = '' ) {
    	$user = get_userdata( $user_id );
    	if ( ! $user ) {
    		return '';
    	}

    	if ( ! $token ) {
    		$manager = WP_Session_Tokens::get_instance( $user_id );
    		$token   = $manager->create( $expiration );
    	}

    	if ( str_starts_with( $user->user_pass, '$P$' ) || str_starts_with( $user->user_pass, '$2y$' ) ) {
    		// Retain previous behaviour of phpass or vanilla bcrypt hashed passwords.
    		$pass_frag = substr( $user->user_pass, 8, 4 );
    	} else {
    		// Otherwise, use a substring from the end of the hash to avoid dealing with potentially long hash prefixes.
    		$pass_frag = substr( $user->user_pass, -4 );
    	}

    	$key = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );

    	$hash = hash_hmac( 'sha256', $user->user_login . '|' . $expiration . '|' . $token, $key );

    	$cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash;

    	/**
    	 * Filters the authentication cookie.
    	 *
    	 * @since 2.5.0
    	 * @since 4.0.0 The `$token` parameter was added.
    	 *
    	 * @param string $cookie     Authentication cookie.
    	 * @param int    $user_id    User ID.
    	 * @param int    $expiration The time the cookie expires as a UNIX timestamp.
    	 * @param string $scheme     Cookie scheme used. Accepts 'auth', 'secure_auth', or 'logged_in'.
    	 * @param string $token      User's session token used.
    	 */
    	return apply_filters( 'auth_cookie', $cookie, $user_id, $expiration, $scheme, $token );
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/pluggable.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.1/src/wp-includes/pluggable.php#L951)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.1/src/wp-includes/pluggable.php#L951-L989)

## 󠀁[Hooks](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#hooks)󠁿

 [apply_filters( ‘auth_cookie’, string $cookie, int $user_id, int $expiration, string $scheme, string $token )](https://developer.wordpress.org/reference/hooks/auth_cookie/)

Filters the authentication cookie.

## 󠀁[Related](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#related)󠁿

| Uses | Description | 
| [WP_Session_Tokens::get_instance()](https://developer.wordpress.org/reference/classes/wp_session_tokens/get_instance/)`wp-includes/class-wp-session-tokens.php` |

Retrieves a session manager instance for a user.

  | 
| [wp_hash()](https://developer.wordpress.org/reference/functions/wp_hash/)`wp-includes/pluggable.php` |

Gets the hash of the given string.

  | 
| [get_userdata()](https://developer.wordpress.org/reference/functions/get_userdata/)`wp-includes/pluggable.php` |

Retrieves user info by user ID.

  | 
| [apply_filters()](https://developer.wordpress.org/reference/functions/apply_filters/)`wp-includes/plugin.php` |

Calls the callback functions that have been added to a filter hook.

  |

[Show 2 more](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#)
[Show less](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#)

| Used by | Description | 
| [wp_set_auth_cookie()](https://developer.wordpress.org/reference/functions/wp_set_auth_cookie/)`wp-includes/pluggable.php` |

Sets the authentication cookies for a given user ID.

  |

## 󠀁[Changelog](https://developer.wordpress.org/reference/functions/wp_generate_auth_cookie/?output_format=md#changelog)󠁿

| Version | Description | 
| [4.0.0](https://developer.wordpress.org/reference/since/4.0.0/) | The `$token` parameter was added. | 
| [2.5.0](https://developer.wordpress.org/reference/since/2.5.0/) | Introduced. |

## User Contributed Notes

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_generate_auth_cookie%2F)
before being able to contribute a note or feedback.