Which HTTP response header tells a browser to store a cookie?

The HTTP response header that tells a browser to store a cookie is `Set-Cookie`.

A web server sends this header in its response, followed by a cookie name, value, and optional attributes such as `Expires`, `Max-Age`, `Domain`, `Path`, `Secure`, and `HttpOnly`. For example, `Set-Cookie: theme=light` asks the browser to save a cookie named `theme`.

On later requests, the browser sends matching stored cookies back in a request header called `Cookie`. That direction is the common source of confusion: `Set-Cookie` travels from server to browser, while `Cookie` travels from browser to server. `Location` redirects a browser, and `ETag` helps identify a particular representation of a resource; neither stores cookies.

Cookies allow otherwise stateless HTTP exchanges to maintain state, such as a login session or shopping cart. A cookie without an expiration attribute is generally a session cookie, while `Expires` or `Max-Age` can make it persistent.