Cache-Control: max-age, no-cache, no-store, private and public

Five directives cover most API responses, and each answers who may store it and for how long.

The Cache-Control response header tells every cache what it may do with a response, through directives separated by commas. Five cover most API responses: max-age sets how long a copy stays fresh, no-cache allows storing but requires checking with the server before each use, no-store forbids storing at all, private allows only the user's own cache, and public allows shared caches too.

Common Cache-Control directives, who may store the response, for how long, and a typical endpoint
Directive	Who may store it	How long it is used without asking	Typical endpoint
max-age=3600	Any cache, unless private is also set	One hour	GET /products
s-maxage=600	Applies to shared caches only	Ten minutes, overriding max-age there	A list a CDN may hold more briefly than browsers
no-cache	Any cache	Never; it revalidates before every use	GET /orders/42, which must always be current
no-store	Nobody	Not stored at all	A password reset token, a payment card
private	Only the user's own browser	As max-age says	GET /me
public	Shared caches too, even for authenticated requests	As max-age says	Public data behind a login

Combining them. Directives combine: Cache-Control: private, max-age=60 lets the browser reuse a profile for a minute and keeps it out of the CDN. public, max-age=86400, immutable says a versioned file such as /assets/app.3f9a.js will never change, so caches need not even revalidate.

Defaults by kind of data.

Public data that changes slowly, such as a product list: public, max-age with a lifetime the business can accept stale data for.
Personal data, such as an account page: private, with no-cache or a short max-age.
Secrets and one-time values, such as tokens and card details: no-store.

public is rarely needed. Shared caches already store most GET responses that have a max-age. public matters mainly for responses to requests that carried an Authorization header, which shared caches otherwise refuse to store.

Lifetimes are a business decision. A one-hour max-age means a price change may take an hour to reach every user. Choose the longest lifetime the data can be stale for, not the one that sounds efficient.

So set Cache-Control on every response, from three questions: may a shared cache keep it, how long may it be stale, and must it never be stored?

← → move through sections and cards