Sharing the same visitor identity between our marketing site and app subdomain
Our marketing site runs on the apex domain and the product runs on an app subdomain, both Next apps. Right now a visitor who crosses from marketing to the app is treated as two different people, which breaks continuity for personalization and experiment assignment.
I want the same visitor recognized across both. Since Croct stores its identity in cookies, I assume this is a matter of scoping them correctly. What is the right way to set the cookie domain so both sites read the same client?
2 answers
You are on the right track, it is cookie scoping. Croct uses the ct.client_id cookie (roughly a year) and the ct.user_token cookie (roughly 7 days) to carry identity. By default they are scoped to the origin that set them, which is why apex and app.subdomain read as two visitors.
Set a domain on the cookie options so the cookies are shared across subdomains, for example the parent domain, and both sites will resolve the same client. The cookie settings are configurable through the SDK, name, domain, path and sameSite, so you point both apps at the same domain scope. There is more on the lifetimes and where they are set in the Next.js cookie lifetimes thread.
One layer above the cookie domain to be aware of: the anonymity scope setting governs how broadly an anonymous profile is shared, Application, Workspace which is the default, or Organization. The cookie domain gets both subdomains reading the same client, and the scope decides how widely that anonymous profile is considered the same person. If tokens ever need to stay separate per context, that is the tokenScope conversation instead, see this tokenScope thread.
Set the cookie domain to the parent and both subdomains now resolve the same visitor, experiment assignment stays consistent across the crossover. The scope note was useful context too, thanks.