diff --git a/API/FamilyTreeAPI/Controllers/UsersController.cs b/API/FamilyTreeAPI/Controllers/UsersController.cs
index 79d05e7..bd385d3 100644
--- a/API/FamilyTreeAPI/Controllers/UsersController.cs
+++ b/API/FamilyTreeAPI/Controllers/UsersController.cs
@@ -37,8 +37,25 @@ public class UsersController : ControllerBase
     public async Task<IActionResult> LoginApiAD([FromBody] AuthenticateRequest model)
     {
         string remoteIpAddress = HttpContext.Connection.RemoteIpAddress?.ToString();
-        var response = await _userService.LoginApiAD(model, remoteIpAddress);
-        return Ok(response);
+                    var rval = await _repoUser.LoginApiAD(userdetail, remoteIpAddress);
+          if (rval.Data  != null && rval.Data.Token != null)
+            {
+                // Configure cookie options
+
+                var cookieOptions = new CookieOptions
+                {
+                    HttpOnly = true,                  // Blocks client-side JavaScript reading/theft
+                    Secure = false,                    // Requires HTTPS connections
+                    SameSite = SameSiteMode.Unspecified,   // Prevents CSRF attacks
+                    Expires = DateTimeOffset.UtcNow.AddDays(1), // Match your token lifespan
+                    Path = "/"                        // Accessible across entire domain structure
+                };
+
+                // Write cookie into response headers
+                Response.Cookies.Append("token", rval.Data.Token, cookieOptions);
+            }
+            return Ok(rval);
+
     }
 
     [HttpPost("[action]")]
@@ -51,6 +68,14 @@ public class UsersController : ControllerBase
         string token = Request.Headers["Authorization"].FirstOrDefault()?.Split(" ").Last();
         string remoteIpAddress = Request.HttpContext.Connection.RemoteIpAddress.ToString();
         var response = await _userService.Logout(token, currentUser, remoteIpAddress);
+          Response.Cookies.Delete("token", new CookieOptions
+            {
+                HttpOnly = true,
+                Secure = false,
+                SameSite = SameSiteMode.Unspecified,
+                    Path = "/"
+            });
+
         return Ok(response);
     }