# Sharing the same visitor identity between our marketing site and app subdomain

Asked by Bianca Fonseca on 2026-10-15. Tags: nextjs, identity, cookies.

Our marketing site runs on the apex domain and the product runs on an app
subdomain, both Next apps. Right now a visitor who crosses from marketing to the
app is treated as two different people, which breaks continuity for
personalization and experiment assignment.

I want the same visitor recognized across both. Since Croct stores its identity
in cookies, I assume this is a matter of scoping them correctly. What is the
right way to set the cookie domain so both sites read the same client?

## 2 answers

### Accepted answer from Tom Alvarez (2026-10-16)

You are on the right track, it is cookie scoping. Croct uses the
`ct.client_id` cookie (roughly a year) and the `ct.user_token` cookie
(roughly 7 days) to carry identity. By default they are scoped to the origin
that set them, which is why apex and app.subdomain read as two visitors.

Set a `domain` on the cookie options so the cookies are shared across
subdomains, for example the parent domain, and both sites will resolve the
same client. The cookie settings are configurable through the SDK, name,
domain, path and sameSite, so you point both apps at the same domain scope.
There is more on the lifetimes and where they are set in
[the Next.js cookie lifetimes thread](/answers/croct-cookie-lifetimes-nextjs).

### Answer from Renata Fuchs (2026-10-17)

One layer above the cookie domain to be aware of: the anonymity scope setting
governs how broadly an anonymous profile is shared, Application, Workspace
which is the default, or Organization. The cookie domain gets both subdomains
reading the same client, and the scope decides how widely that anonymous
profile is considered the same person. If tokens ever need to stay separate
per context, that is the tokenScope conversation instead, see
[this tokenScope thread](/answers/tokenscope-multiple-accounts-tabs).

#### Reply from Bianca Fonseca (2026-10-18)

Set the cookie domain to the parent and both subdomains now resolve the
same visitor, experiment assignment stays consistent across the crossover.
The scope note was useful context too, thanks.