diff --git a/src/middleware/adminAuth.ts b/src/middleware/adminAuth.ts
index bc48965..55e7846 100644
--- a/src/middleware/adminAuth.ts
+++ b/src/middleware/adminAuth.ts
@@ -1,5 +1,6 @@
 import crypto from 'node:crypto'
 import type { Context, Next } from 'hono'
+import { hasValidReviewerSession } from './reviewerSession.js'
 
 /**
  * Shared admin authentication middleware.
@@ -26,7 +27,10 @@ export async function adminAuth(c: Context, next: Next) {
     return c.json({ error: 'Admin key not configured' }, 503)
   }
 
-  if (!hasValidAdminKey(c.req.header('x-admin-key'))) {
+  const headerAuthorized = hasValidAdminKey(c.req.header('x-admin-key'))
+  const reviewerSessionAuthorized = headerAuthorized ? false : await hasValidReviewerSession(c)
+
+  if (!headerAuthorized && !reviewerSessionAuthorized) {
     return c.json({ error: 'Unauthorized' }, 401)
   }
   await next()
diff --git a/src/middleware/reviewerSession.ts b/src/middleware/reviewerSession.ts
new file mode 100644
index 0000000..62e019a
--- /dev/null
+++ b/src/middleware/reviewerSession.ts
@@ -0,0 +1,39 @@
+import type { Context } from 'hono'
+import { deleteCookie, getSignedCookie, setSignedCookie } from 'hono/cookie'
+
+export const REVIEWER_SESSION_COOKIE = 'djd_reviewer_session'
+export const REVIEWER_SESSION_MAX_AGE_SECONDS = 60 * 60 * 8
+const REVIEWER_SESSION_VALUE = 'reviewer'
+
+function getReviewerSessionCookieOptions() {
+  return {
+    httpOnly: true,
+    maxAge: REVIEWER_SESSION_MAX_AGE_SECONDS,
+    path: '/',
+    sameSite: 'Strict' as const,
+    secure: process.env.NODE_ENV === 'production',
+  }
+}
+
+export async function hasValidReviewerSession(c: Context): Promise<boolean> {
+  const adminKey = process.env.ADMIN_KEY
+  if (!adminKey) {
+    return false
+  }
+
+  const session = await getSignedCookie(c, adminKey, REVIEWER_SESSION_COOKIE)
+  return session === REVIEWER_SESSION_VALUE
+}
+
+export async function startReviewerSession(c: Context): Promise<void> {
+  const adminKey = process.env.ADMIN_KEY
+  if (!adminKey) {
+    return
+  }
+
+  await setSignedCookie(c, REVIEWER_SESSION_COOKIE, REVIEWER_SESSION_VALUE, adminKey, getReviewerSessionCookieOptions())
+}
+
+export function clearReviewerSession(c: Context): void {
+  deleteCookie(c, REVIEWER_SESSION_COOKIE, getReviewerSessionCookieOptions())
+}
diff --git a/src/routes/reviewer.ts b/src/routes/reviewer.ts
index 5377c3b..6cacebb 100644
--- a/src/routes/reviewer.ts
+++ b/src/routes/reviewer.ts
@@ -1,12 +1,63 @@
 import { Hono } from 'hono'
+import { ErrorCodes, errorResponse } from '../errors.js'
+import { hasValidAdminKey } from '../middleware/adminAuth.js'
+import {
+  clearReviewerSession,
+  hasValidReviewerSession,
+  REVIEWER_SESSION_MAX_AGE_SECONDS,
+  startReviewerSession,
+} from '../middleware/reviewerSession.js'
 import { reviewerPageHtml } from '../templates/reviewer.js'
 
 const reviewer = new Hono()
 
+reviewer.use('*', async (c, next) => {
+  c.header('Cache-Control', 'no-store')
+  await next()
+})
+
 reviewer.get('/', (c) => {
   c.header('Content-Type', 'text/html; charset=utf-8')
-  c.header('Cache-Control', 'no-store')
   return c.body(reviewerPageHtml())
 })
 
+reviewer.get('/session', async (c) => {
+  const authenticated = await hasValidReviewerSession(c)
+  return c.json({
+    authenticated,
+    expires_in_seconds: authenticated ? REVIEWER_SESSION_MAX_AGE_SECONDS : 0,
+  })
+})
+
+reviewer.post('/session', async (c) => {
+  if (!process.env.ADMIN_KEY) {
+    return c.json({ error: 'Admin key not configured' }, 503)
+  }
+
+  const body = await c.req.json<{ admin_key?: string }>().catch(() => null)
+  if (!body) {
+    return c.json(errorResponse(ErrorCodes.INVALID_JSON, 'Invalid JSON body'), 400)
+  }
+
+  if (!hasValidAdminKey(body.admin_key)) {
+    return c.json(errorResponse('unauthorized', 'Unauthorized'), 401)
+  }
+
+  await startReviewerSession(c)
+  return c.json({
+    authenticated: true,
+    expires_in_seconds: REVIEWER_SESSION_MAX_AGE_SECONDS,
+    message: 'Reviewer session started.',
+  })
+})
+
+reviewer.delete('/session', (c) => {
+  clearReviewerSession(c)
+  return c.json({
+    authenticated: false,
+    expires_in_seconds: 0,
+    message: 'Reviewer session ended.',
+  })
+})
+
 export default reviewer
diff --git a/src/templates/legal.ts b/src/templates/legal.ts
index dee7edc..3b0b017 100644
--- a/src/templates/legal.ts
+++ b/src/templates/legal.ts
@@ -127,7 +127,7 @@ export const tosContent = `
 export const privacyContent = `
 <h1 class="title">DJD AGENT SCORE</h1>
 <h1 class="subtitle">PRIVACY POLICY</h1>
-<p class="date">Last Updated: February 20, 2026</p>
+<p class="date">Last Updated: March 14, 2026</p>
 
 <p>This Privacy Policy describes how DJD Agent Score (&ldquo;<strong>Company,</strong>&rdquo; &ldquo;<strong>we,</strong>&rdquo; &ldquo;<strong>our</strong>&rdquo;) collects, uses, stores, and discloses information in connection with the DJD Agent Score API and related services (the &ldquo;<strong>Service</strong>&rdquo;). By using the Service, you acknowledge and agree to this Privacy Policy.</p>
 
@@ -157,8 +157,11 @@ export const privacyContent = `
 <h2>2.3 User-Submitted Data</h2>
 <p>When you submit fraud reports, ratings, or other content through the Service, we collect the content of your submission, the submitting wallet address, the target wallet address, supporting evidence (transaction hashes), and timestamps. All user-submitted data is voluntary.</p>
 
-<h2>2.4 Information We Do NOT Collect</h2>
-<p>We do not collect names, email addresses, phone numbers, physical addresses, government identification numbers, biometric data, or any traditional PII. We do not use cookies, tracking pixels, or browser fingerprinting. We do not integrate with advertising networks. The Service does not have user accounts, logins, or passwords.</p>
+<h2>2.4 Reviewer Session Data</h2>
+<p>The internal reviewer dashboard uses a short-lived, signed <code>HttpOnly</code> session cookie to authenticate administrative review actions. This cookie is not used for advertising, analytics, or cross-site tracking. It exists solely to protect internal certification review workflows and expires automatically.</p>
+
+<h2>2.5 Information We Do NOT Collect</h2>
+<p>We do not collect names, email addresses, phone numbers, physical addresses, government identification numbers, biometric data, or any traditional PII. We do not use tracking pixels or browser fingerprinting. We do not integrate with advertising networks. The Service does not have consumer-facing user accounts, social profiles, or password-based logins.</p>
 
 <h1>3. How We Use Information</h1>
 <p><strong>Service delivery:</strong> Calculating reputation scores, processing fraud reports, generating leaderboards, and serving API responses.</p>
diff --git a/src/templates/reviewer.ts b/src/templates/reviewer.ts
index be60b0f..bb9f609 100644
--- a/src/templates/reviewer.ts
+++ b/src/templates/reviewer.ts
@@ -1,3 +1,7 @@
+import { REVIEWER_SESSION_MAX_AGE_SECONDS } from '../middleware/reviewerSession.js'
+
+const REVIEWER_SESSION_HOURS = Math.floor(REVIEWER_SESSION_MAX_AGE_SECONDS / 3600)
+
 export function reviewerPageHtml(): string {
   return `<!DOCTYPE html>
 <html lang="en">
@@ -112,7 +116,7 @@ export function reviewerPageHtml(): string {
 <body>
   <div class="wrap">
     <h1>Certification Reviewer Dashboard</h1>
-    <p class="sub">Internal operations surface for DJD Certify. Load the review queue with an admin key, inspect score and profile context, then approve, request more information, reject, or issue a certification from an approved review.</p>
+    <p class="sub">Internal operations surface for DJD Certify. Start a short-lived reviewer session with the admin key, inspect score and profile context, then approve, request more information, reject, or issue a certification from an approved review.</p>
 
     <div class="card">
       <div class="auth-row">
@@ -145,10 +149,12 @@ export function reviewerPageHtml(): string {
         </div>
       </div>
       <div class="action-row" style="margin-top:14px">
+        <button class="btn btn-primary" id="loginBtn" onclick="startSession()">Start Reviewer Session</button>
         <button class="btn btn-primary" id="loadBtn" onclick="loadQueue()">Load Review Queue</button>
+        <button class="btn btn-secondary" id="logoutBtn" onclick="endSession()">End Session</button>
         <button class="btn btn-secondary" onclick="clearDashboard()">Clear</button>
       </div>
-      <div class="note">This dashboard keeps the admin key and queue filters in <code>sessionStorage</code> for the current tab only.</div>
+      <div class="note">Reviewer authentication uses a signed <code>HttpOnly</code> cookie for up to ${REVIEWER_SESSION_HOURS} hours. Only queue filters stay in <code>sessionStorage</code> for the current tab.</div>
       <div class="status" id="statusMsg"></div>
       <div class="error" id="errorMsg"></div>
     </div>
@@ -162,9 +168,11 @@ export function reviewerPageHtml(): string {
   </div>
 
 <script>
+const SESSION_API='/reviewer/session';
 const REVIEWS_API='/v1/certification/admin/reviews';
 const REVIEWER_STORAGE_KEY='djd-reviewer-dashboard';
 const DEFAULT_LIMIT='24';
+let reviewerAuthenticated=false;
 
 function esc(value){
   return String(value)
@@ -229,7 +237,6 @@ function getSearchFilter(){
 
 function getDashboardState(){
   return {
-    adminKey: document.getElementById('adminKey').value,
     search: document.getElementById('searchFilter').value,
     status: document.getElementById('statusFilter').value,
     limit: document.getElementById('limitFilter').value || DEFAULT_LIMIT
@@ -247,17 +254,15 @@ function persistDashboardState(){
 function restoreDashboardState(){
   try{
     const rawState=window.sessionStorage.getItem(REVIEWER_STORAGE_KEY);
-    if(!rawState) return false;
+    if(!rawState) return;
     const state=JSON.parse(rawState);
-    if(!state || typeof state !== 'object') return false;
+    if(!state || typeof state !== 'object') return;
 
-    if(typeof state.adminKey === 'string') document.getElementById('adminKey').value=state.adminKey;
     if(typeof state.search === 'string') document.getElementById('searchFilter').value=state.search;
     if(typeof state.status === 'string') document.getElementById('statusFilter').value=state.status;
     if(typeof state.limit === 'string' && state.limit) document.getElementById('limitFilter').value=state.limit;
-    return Boolean(typeof state.adminKey === 'string' && state.adminKey.trim());
   }catch{
-    return false;
+    return;
   }
 }
 
@@ -280,6 +285,41 @@ function getQueueParams(){
   return params;
 }
 
+function defaultQueueMeta(){
+  return reviewerAuthenticated ? 'Reviewer session active' : 'Start a reviewer session';
+}
+
+function setQueueMeta(value){
+  document.getElementById('queueMeta').textContent=value;
+}
+
+function setButtonBusy(id, busy, idleLabel, busyLabel){
+  const button=document.getElementById(id);
+  button.disabled=busy;
+  button.textContent=busy ? busyLabel : idleLabel;
+}
+
+function syncAuthUi(authenticated){
+  reviewerAuthenticated=Boolean(authenticated);
+  document.getElementById('adminKey').disabled=reviewerAuthenticated;
+  document.getElementById('loginBtn').disabled=reviewerAuthenticated;
+  document.getElementById('logoutBtn').disabled=!reviewerAuthenticated;
+  document.getElementById('loadBtn').disabled=!reviewerAuthenticated;
+  if(!document.getElementById('queue').innerHTML){
+    setQueueMeta(defaultQueueMeta());
+  }
+}
+
+async function parseJsonResponse(res){
+  const text=await res.text();
+  if(!text) return null;
+  try{
+    return JSON.parse(text);
+  }catch{
+    return null;
+  }
+}
+
 function buildQueueMeta(body){
   const parts=['Showing ' + body.returned + ' review request(s)'];
   if(body.filters && body.filters.status) parts.push(labelForStatus(body.filters.status));
@@ -326,30 +366,104 @@ function renderRequest(request){
   '</article>';
 }
 
-async function loadQueue(){
+async function refreshSessionStatus(){
+  try{
+    const res=await fetch(SESSION_API,{cache:'no-store',credentials:'same-origin'});
+    const body=await parseJsonResponse(res);
+    syncAuthUi(Boolean(body && body.authenticated));
+  }catch{
+    syncAuthUi(false);
+  }
+}
+
+async function startSession(){
   clearMessages();
   const adminKey=getAdminKey();
   if(!adminKey){
-    showError('Enter the admin key before loading reviewer data.');
+    showError('Enter the admin key to start a reviewer session.');
     return;
   }
 
-  persistDashboardState();
+  setButtonBusy('loginBtn', true, 'Start Reviewer Session', 'Starting...');
+  try{
+    const res=await fetch(SESSION_API,{
+      method:'POST',
+      headers:{'Content-Type':'application/json'},
+      cache:'no-store',
+      credentials:'same-origin',
+      body:JSON.stringify({admin_key:adminKey})
+    });
+    const body=await parseJsonResponse(res);
+    if(!res.ok){
+      throw new Error(body && body.error && body.error.message ? body.error.message : 'Unable to start reviewer session');
+    }
+    document.getElementById('adminKey').value='';
+    syncAuthUi(true);
+    showStatus(body && body.message ? body.message : 'Reviewer session started.');
+    await loadQueue();
+  }catch(err){
+    showError(err && err.message ? err.message : 'Unable to start reviewer session.');
+  }
+  setButtonBusy('loginBtn', false, 'Start Reviewer Session', 'Starting...');
+}
 
-  const button=document.getElementById('loadBtn');
-  button.disabled=true;
-  button.textContent='Loading...';
+async function endSession(){
+  clearMessages();
+  setButtonBusy('logoutBtn', true, 'End Session', 'Ending...');
+  try{
+    const res=await fetch(SESSION_API,{
+      method:'DELETE',
+      cache:'no-store',
+      credentials:'same-origin'
+    });
+    const body=await parseJsonResponse(res);
+    if(!res.ok){
+      throw new Error(body && body.error && body.error.message ? body.error.message : 'Unable to end reviewer session');
+    }
+    document.getElementById('adminKey').value='';
+    document.getElementById('queue').innerHTML='';
+    syncAuthUi(false);
+    setQueueMeta(defaultQueueMeta());
+    showStatus(body && body.message ? body.message : 'Reviewer session ended.');
+  }catch(err){
+    showError(err && err.message ? err.message : 'Unable to end reviewer session.');
+  }
+  setButtonBusy('logoutBtn', false, 'End Session', 'Ending...');
+}
+
+async function handleAuthFailure(){
+  document.getElementById('queue').innerHTML='';
+  syncAuthUi(false);
+  setQueueMeta('Reviewer session expired');
+  showError('Reviewer session expired. Start a new reviewer session.');
+}
+
+async function loadQueue(){
+  clearMessages();
+  if(!reviewerAuthenticated){
+    showError('Start a reviewer session before loading reviewer data.');
+    return;
+  }
+
+  persistDashboardState();
+  setButtonBusy('loadBtn', true, 'Load Review Queue', 'Loading...');
   try{
     const params=getQueueParams();
-    const res=await fetch(REVIEWS_API + '?' + params.toString(),{
-      headers:{'x-admin-key':adminKey}
+    const query=params.toString();
+    const res=await fetch(REVIEWS_API + (query ? '?' + query : ''),{
+      cache:'no-store',
+      credentials:'same-origin'
     });
-    const body=await res.json();
+    const body=await parseJsonResponse(res);
+    if(res.status === 401){
+      await handleAuthFailure();
+      return;
+    }
     if(!res.ok){
       throw new Error(body && body.error && body.error.message ? body.error.message : 'Unable to load review queue');
     }
 
-    document.getElementById('queueMeta').textContent=buildQueueMeta(body);
+    setQueueMeta(buildQueueMeta(body));
     document.getElementById('queue').innerHTML=body.returned
       ? body.requests.map(renderRequest).join('')
       : '<div class="card empty">No review requests matched the current filter.</div>';
@@ -357,15 +471,13 @@ async function loadQueue(){
   }catch(err){
     showError(err && err.message ? err.message : 'Unable to load reviewer queue.');
   }
-  button.disabled=false;
-  button.textContent='Load Review Queue';
+  setButtonBusy('loadBtn', !reviewerAuthenticated, 'Load Review Queue', 'Loading...');
 }
 
 async function decision(id, status){
   clearMessages();
-  const adminKey=getAdminKey();
-  if(!adminKey){
-    showError('Enter the admin key before submitting reviewer actions.');
+  if(!reviewerAuthenticated){
+    showError('Start a reviewer session before submitting reviewer actions.');
     return;
   }
   persistDashboardState();
@@ -377,21 +489,26 @@ async function decision(id, status){
     const res=await fetch('/v1/certification/admin/reviews/' + id + '/decision',{
       method:'POST',
       headers:{
-        'Content-Type':'application/json',
-        'x-admin-key':adminKey
+        'Content-Type':'application/json'
       },
+      cache:'no-store',
+      credentials:'same-origin',
       body:JSON.stringify({
         decision:status,
         note:note || undefined,
         reviewed_by:'reviewer-dashboard'
       })
     });
-    const body=await res.json();
+    const body=await parseJsonResponse(res);
+    if(res.status === 401){
+      await handleAuthFailure();
+      return;
+    }
     if(!res.ok){
       throw new Error(body && body.error && body.error.message ? body.error.message : 'Unable to update review request');
     }
     showStatus('Review updated to ' + labelForStatus(body.status).toLowerCase() + '.');
-    loadQueue();
+    await loadQueue();
   }catch(err){
     showError(err && err.message ? err.message : 'Unable to update review request.');
   }
@@ -399,9 +516,8 @@ async function decision(id, status){
 
 async function issueRequest(id){
   clearMessages();
-  const adminKey=getAdminKey();
-  if(!adminKey){
-    showError('Enter the admin key before issuing certifications.');
+  if(!reviewerAuthenticated){
+    showError('Start a reviewer session before issuing certifications.');
     return;
   }
   persistDashboardState();
@@ -411,14 +527,19 @@ async function issueRequest(id){
   try{
     const res=await fetch('/v1/certification/admin/reviews/' + id + '/issue',{
       method:'POST',
-      headers:{'x-admin-key':adminKey}
+      cache:'no-store',
+      credentials:'same-origin'
     });
-    const body=await res.json();
+    const body=await parseJsonResponse(res);
+    if(res.status === 401){
+      await handleAuthFailure();
+      return;
+    }
     if(!res.ok){
       throw new Error(body && body.error && body.error.message ? body.error.message : 'Unable to issue certification');
     }
     showStatus('Certification issued for ' + body.certification.wallet + '.');
-    loadQueue();
+    await loadQueue();
   }catch(err){
     showError(err && err.message ? err.message : 'Unable to issue certification.');
   }
@@ -427,16 +548,16 @@ async function issueRequest(id){
 function clearDashboard(){
   clearMessages();
   document.getElementById('queue').innerHTML='';
-  document.getElementById('queueMeta').textContent='Queue idle';
   document.getElementById('adminKey').value='';
   document.getElementById('searchFilter').value='';
   document.getElementById('statusFilter').value='';
   document.getElementById('limitFilter').value=DEFAULT_LIMIT;
   clearStoredDashboardState();
+  setQueueMeta(defaultQueueMeta());
 }
 
 function attachPersistenceListeners(){
-  ['adminKey','searchFilter'].forEach(function(id){
+  ['searchFilter'].forEach(function(id){
     document.getElementById(id).addEventListener('input', persistDashboardState);
   });
   ['statusFilter','limitFilter'].forEach(function(id){
@@ -447,16 +568,23 @@ function attachPersistenceListeners(){
 function attachLoadShortcuts(){
   ['adminKey','searchFilter'].forEach(function(id){
     document.getElementById(id).addEventListener('keydown', function(event){
-      if(event.key === 'Enter') loadQueue();
+      if(event.key === 'Enter'){
+        if(id === 'adminKey' && !reviewerAuthenticated){
+          startSession();
+          return;
+        }
+        loadQueue();
+      }
     });
   });
 }
 
-function initDashboard(){
-  const restoredAdminKey=restoreDashboardState();
+async function initDashboard(){
+  restoreDashboardState();
   attachPersistenceListeners();
   attachLoadShortcuts();
-  if(restoredAdminKey) loadQueue();
+  await refreshSessionStatus();
+  if(reviewerAuthenticated) loadQueue();
 }
 
 initDashboard();
diff --git a/tests/routes/admin.test.ts b/tests/routes/admin.test.ts
index ae7940e..9b9088a 100644
--- a/tests/routes/admin.test.ts
+++ b/tests/routes/admin.test.ts
@@ -154,6 +154,40 @@ describe('admin middleware', () => {
     expect(res.status).toBe(401)
   })
 
+  it('accepts a reviewer session cookie instead of x-admin-key', async () => {
+    process.env.ADMIN_KEY = 'secret-key'
+    state.generateCalibrationReport.mockReturnValue({
+      avg_score_by_outcome: '{"positive":{"avgScore":80}}',
+      tier_accuracy: '{"Trusted":0.8}',
+      recommendations: '["keep going"]',
+    })
+
+    const { Hono } = await import('hono')
+    const { default: adminRoute } = await import('../../src/routes/admin.js')
+    const { default: reviewerRoute } = await import('../../src/routes/reviewer.js')
+
+    const app = new Hono()
+    app.route('/admin', adminRoute)
+    app.route('/reviewer', reviewerRoute)
+
+    const sessionRes = await app.request('/reviewer/session', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ admin_key: 'secret-key' }),
+    })
+    expect(sessionRes.status).toBe(200)
+
+    const sessionCookie = sessionRes.headers.get('set-cookie')
+    expect(sessionCookie).toContain('djd_reviewer_session=')
+
+    const res = await app.request('/admin/calibration', {
+      headers: { Cookie: sessionCookie?.split(';')[0] ?? '' },
+    })
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.avg_score_by_outcome).toEqual({ positive: { avgScore: 80 } })
+  })
+
   it('returns a generated calibration report when no cached report exists', async () => {
     process.env.ADMIN_KEY = 'secret-key'
     state.generateCalibrationReport.mockReturnValue({
diff --git a/tests/routes/legal.test.ts b/tests/routes/legal.test.ts
index 34c26fa..2b86782 100644
--- a/tests/routes/legal.test.ts
+++ b/tests/routes/legal.test.ts
@@ -58,4 +58,18 @@ describe('GET /', () => {
     delete process.env.PUBLIC_BASE_URL
     delete process.env.PUBLIC_SUPPORT_EMAIL
   })
+
+  it('describes internal reviewer session cookies in the privacy policy', async () => {
+    const app = new Hono()
+    app.route('/', legalRoute)
+
+    const res = await app.request('/privacy')
+    expect(res.status).toBe(200)
+
+    const body = await res.text()
+    expect(body).toContain('Reviewer Session Data')
+    expect(body).toContain('short-lived, signed')
+    expect(body).toContain('HttpOnly')
+    expect(body).toContain('We do not use tracking pixels or browser fingerprinting')
+  })
 })
diff --git a/tests/routes/reviewerPage.test.ts b/tests/routes/reviewerPage.test.ts
index 4a5b26f..ffe8c99 100644
--- a/tests/routes/reviewerPage.test.ts
+++ b/tests/routes/reviewerPage.test.ts
@@ -1,8 +1,22 @@
 import { Hono } from 'hono'
-import { describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import reviewerRoute from '../../src/routes/reviewer.js'
 
+const ORIGINAL_ADMIN_KEY = process.env.ADMIN_KEY
+
 describe('GET /reviewer', () => {
+  beforeEach(() => {
+    process.env.ADMIN_KEY = 'reviewer-secret-key-1234567890123456'
+  })
+
+  afterEach(() => {
+    if (ORIGINAL_ADMIN_KEY !== undefined) {
+      process.env.ADMIN_KEY = ORIGINAL_ADMIN_KEY
+    } else {
+      delete process.env.ADMIN_KEY
+    }
+  })
+
   it('renders the certification reviewer dashboard page', async () => {
     const app = new Hono()
     app.route('/reviewer', reviewerRoute)
@@ -15,10 +29,50 @@ describe('GET /reviewer', () => {
     const body = await res.text()
     expect(body).toContain('Certification Reviewer Dashboard')
     expect(body).toContain('/v1/certification/admin/reviews')
+    expect(body).toContain('/reviewer/session')
     expect(body).toContain('Issue Certification')
-    expect(body).toContain('Enter the admin key')
+    expect(body).toContain('Start Reviewer Session')
     expect(body).toContain('Wallet, name, or description')
+    expect(body).toContain('HttpOnly')
     expect(body).toContain('sessionStorage')
     expect(body).toContain('djd-reviewer-dashboard')
   })
+
+  it('creates, reports, and clears reviewer session cookies', async () => {
+    const app = new Hono()
+    app.route('/reviewer', reviewerRoute)
+
+    const startRes = await app.request('/reviewer/session', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ admin_key: process.env.ADMIN_KEY }),
+    })
+
+    expect(startRes.status).toBe(200)
+    expect(startRes.headers.get('cache-control')).toBe('no-store')
+    const startBody = (await startRes.json()) as { authenticated: boolean; expires_in_seconds: number }
+    expect(startBody.authenticated).toBe(true)
+    expect(startBody.expires_in_seconds).toBeGreaterThan(0)
+
+    const sessionCookie = startRes.headers.get('set-cookie')
+    expect(sessionCookie).toContain('djd_reviewer_session=')
+    expect(sessionCookie).toContain('HttpOnly')
+
+    const cookieHeader = sessionCookie?.split(';')[0] ?? ''
+    const statusRes = await app.request('/reviewer/session', {
+      headers: { Cookie: cookieHeader },
+    })
+    expect(statusRes.status).toBe(200)
+    const statusBody = (await statusRes.json()) as { authenticated: boolean }
+    expect(statusBody.authenticated).toBe(true)
+
+    const clearRes = await app.request('/reviewer/session', {
+      method: 'DELETE',
+      headers: { Cookie: cookieHeader },
+    })
+    expect(clearRes.status).toBe(200)
+    expect(clearRes.headers.get('set-cookie')).toContain('Max-Age=0')
+    const clearBody = (await clearRes.json()) as { authenticated: boolean }
+    expect(clearBody.authenticated).toBe(false)
+  })
 })