diff --git a/Cargo.lock b/Cargo.lock
index 874b33134f..6bd71f6d38 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5443,17 +5443,22 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "api_identity",
+ "async-trait",
  "base64 0.22.1",
  "chrono",
  "clap",
+ "cookie 0.18.1",
  "derive-where",
  "derive_more",
  "dns-service-client",
+ "dropshot",
  "futures",
  "gateway-client",
+ "http 0.2.12",
  "humantime",
  "ipnetwork",
  "newtype-uuid",
+ "newtype_derive",
  "nexus-sled-agent-shared",
  "omicron-common",
  "omicron-passwords",
diff --git a/nexus/auth/src/authn/external/mod.rs b/nexus/auth/src/authn/external/mod.rs
index ccb7218285..5c7fc7af05 100644
--- a/nexus/auth/src/authn/external/mod.rs
+++ b/nexus/auth/src/authn/external/mod.rs
@@ -13,7 +13,6 @@ use slog::trace;
 use std::borrow::Borrow;
 use uuid::Uuid;
 
-pub mod cookies;
 pub mod session_cookie;
 pub mod spoof;
 pub mod token;
diff --git a/nexus/auth/src/authn/external/session_cookie.rs b/nexus/auth/src/authn/external/session_cookie.rs
index 7811bf2826..f6b23308a0 100644
--- a/nexus/auth/src/authn/external/session_cookie.rs
+++ b/nexus/auth/src/authn/external/session_cookie.rs
@@ -4,7 +4,6 @@
 
 //! authn scheme for console that looks up cookie values in a session table
 
-use super::cookies::parse_cookies;
 use super::{HttpAuthnScheme, Reason, SchemeResult};
 use crate::authn;
 use crate::authn::{Actor, Details};
@@ -13,6 +12,7 @@ use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
 use dropshot::HttpError;
 use http::HeaderValue;
+use nexus_types::authn::cookies::parse_cookies;
 use slog::debug;
 use uuid::Uuid;
 
diff --git a/nexus/src/external_api/console_api.rs b/nexus/src/external_api/console_api.rs
index fb0a47bbea..2169b631a7 100644
--- a/nexus/src/external_api/console_api.rs
+++ b/nexus/src/external_api/console_api.rs
@@ -35,15 +35,13 @@ use nexus_db_model::AuthenticationMode;
 use nexus_db_queries::authn::silos::IdentityProviderType;
 use nexus_db_queries::context::OpContext;
 use nexus_db_queries::{
-    authn::external::{
-        cookies::Cookies,
-        session_cookie::{
-            clear_session_cookie_header_value, session_cookie_header_value,
-            SessionStore, SESSION_COOKIE_COOKIE_NAME,
-        },
+    authn::external::session_cookie::{
+        clear_session_cookie_header_value, session_cookie_header_value,
+        SessionStore, SESSION_COOKIE_COOKIE_NAME,
     },
     db::identity::Asset,
 };
+use nexus_types::authn::cookies::Cookies;
 use nexus_types::external_api::params;
 use nexus_types::identity::Resource;
 use omicron_common::api::external::http_pagination::PaginatedBy;
diff --git a/nexus/types/Cargo.toml b/nexus/types/Cargo.toml
index 8dd6292d5c..124f0d42c9 100644
--- a/nexus/types/Cargo.toml
+++ b/nexus/types/Cargo.toml
@@ -9,14 +9,19 @@ workspace = true
 
 [dependencies]
 anyhow.workspace = true
+async-trait.workspace = true
 chrono.workspace = true
 clap.workspace = true
+cookie.workspace = true
 base64.workspace = true
 derive-where.workspace = true
 derive_more.workspace = true
+dropshot.workspace = true
 futures.workspace = true
+http.workspace = true
 humantime.workspace = true
 ipnetwork.workspace = true
+newtype_derive.workspace = true
 omicron-uuid-kinds.workspace = true
 openssl.workspace = true
 oxql-types.workspace = true
diff --git a/nexus/auth/src/authn/external/cookies.rs b/nexus/types/src/authn/cookies.rs
similarity index 100%
rename from nexus/auth/src/authn/external/cookies.rs
rename to nexus/types/src/authn/cookies.rs
diff --git a/nexus/types/src/authn/mod.rs b/nexus/types/src/authn/mod.rs
new file mode 100644
index 0000000000..f87935428e
--- /dev/null
+++ b/nexus/types/src/authn/mod.rs
@@ -0,0 +1,7 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+//! Authentication types for the Nexus API.
+
+pub mod cookies;
diff --git a/nexus/types/src/lib.rs b/nexus/types/src/lib.rs
index 494573e834..8a0a3ec80e 100644
--- a/nexus/types/src/lib.rs
+++ b/nexus/types/src/lib.rs
@@ -29,6 +29,7 @@
 //! rules, so our model layer knows about our views. That seems to be a
 //! relatively minor offense, so it's the way we leave things for now.
 
+pub mod authn;
 pub mod deployment;
 pub mod external_api;
 pub mod identity;