Store cookie, as this is slightly more secure. While it still do not secures you from the breakage and leakage of the secrets, it is much less plausible that single cookie will be used in more than one service. Alternatively check if the services you are using do not publish some kind of API that you could use with OAuth or similar authorisation protocol.

The lifetime of the cookie is usually a good indicator, but it’s not always accurate as the service can cut it off sooner too.

Good point. For some reason I have a hard time realizing that sites we use are similar to sites we make and I tend to ask stupid questions because of it.