The definition of HTTP only cookies is like this:

Set-Cookie: =“[; “=“] [; expires=“][; domain=“] [; path=“][; secure][; HttpOnly]

thus your question can be rephrased like

the upstream API servers add HTTPOnly tag in HTTP response headers or not?

so it depends on the upstream API servers to add HTTPOnly tag or not. suppose it is a Rust Actix server(you know rust?), you can set a cookie like this:

let cookie = Cookie::build("name", "value")
    .domain("www.rust-lang.org")
    .path("/")
    .secure(true)
    .http_only(true) <- here
    .finish();

assuming there is not proxy or something btw a Next.js server and upstream API servers, your Next.js server side fetch receives the HTTP response as it is.

Can you explain a little bit more because I have a backend in go and i would love to use nextjs as a front end framework

and use its rendering paradigms

but i don't want to use its api routes

when authenticating the client

the client receives 2 tokens access and refresh token

then they get included in very request

but some of the pages i have they require the accesstoken to be fresh

so i refresh it with axios interceptors but the cookies got from the go api does not get stored in the client

is there is a way to like forward the cookies using next from the go api to the client side of next?

how do you fetch the upstream Go API? are you sure you manually set cookie received from Go to the outgoing response to browser?
let us see the code of invoking the go upstream and set cookies.

you can set cookie only from API or Server Actions btw.
https://nextjs.org/docs/app/api-reference/functions/cookies#cookiessetname-value-options

actually im not sure around this. maybe having a reverse proxy in API so useEffect invokes the upstream. any idea?