Today I ran into this question:
How do I set multiple "Set-Cookie" headers in the response message within an Apigee API Proxy?
Here the answer:
You must use the <Set> Element, followed by one or more <Add> elements within the Assign Message policy.
Here is an example:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage continueOnError="false" enabled="true" name="AM-SetCookies">
<DisplayName>AM-SetCookies</DisplayName>
<Properties/>
<Set>
<Headers>
<Header name="Set-Cookie">cookie1=foo;path=/</Header>
</Headers>
<StatusCode>200</StatusCode>
</Set>
<Add>
<Headers>
<Header name="Set-Cookie">cookie2=bar;path=/</Header>
</Headers>
</Add>
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
<AssignTo createNew="false" transport="http" type="request"/>
</AssignMessage>
Hope this helps.