# Identify users across subdomains
Use first-party cookies to recognize anonymous users across subdomains.
By default, the SDK stores identifiers in the browser's [local storage](https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage), which is scoped to a single origin. This is a deliberate privacy-first choice: no external site can access the data, and there is no cross-site tracking. However, it also means that `www.example.com` and `app.example.com` each see a different anonymous user.
A first-party cookie solves this. Because cookies can be scoped to a parent domain, setting one on `example.com` makes it accessible from any subdomain, keeping the identity consistent everywhere.
> **First-party cookies are privacy-friendly**
>
> Unlike third-party cookies, first-party cookies are set by your own domain and are never shared with external sites. They are simply how your application remembers its own visitors, no different from keeping a user logged in.
## Configure the cookie
The SDK uses two cookies: `clientId` identifies the browser, and `userToken` holds the user's token. Both need to be shared across subdomains for full continuity.
To enable this, pass the `cookie` option when initializing the SDK with the `name`, `maxAge`, `domain`, and `path` for both cookies. Make sure to apply this configuration on **every domain and subdomain** where the SDK runs. Otherwise, the cookies won't be shared consistently.
**Plug JS — JavaScript**
```ts
import croct from '@croct/plug';
croct.plug({
appId: 'APPLICATION_ID',
cookie: {
clientId: {
name: 'croct.id',
maxAge: 31536000,
domain: 'example.com',
path: '/'
},
userToken: {
name: 'croct.user_token',
maxAge: 31536000,
domain: 'example.com',
path: '/'
}
}
});
```
**Plug JS — TypeScript**
```ts
import croct from '@croct/plug';
croct.plug({
appId: 'APPLICATION_ID',
cookie: {
clientId: {
name: 'croct.id',
maxAge: 31536000,
domain: 'example.com',
path: '/'
},
userToken: {
name: 'croct.user_token',
maxAge: 31536000,
domain: 'example.com',
path: '/'
}
}
});
```
**Plug JS — HTML**
```html
My awesome application
```
**Plug React — JavaScript**
```jsx
import {CroctProvider} from '@croct/plug-react';
export default function App() {
return (
My first personalized app 🚀
);
}
```
**Plug React — TypeScript**
```tsx
import type {ReactElement} from 'react';
import {CroctProvider} from '@croct/plug-react';
export default function App(): ReactElement {
return (
My first personalized app 🚀
);
}
```
**Plug Vue — JavaScript**
**src/main.ts**
```ts
import {createApp} from 'vue'
import {createCroct} from '@croct/plug-vue'
import App from './App.vue'
const app = createApp(App)
app.use(createCroct({
appId: 'APPLICATION_ID',
cookie: {
clientId: {
name: 'croct.id',
maxAge: 31536000,
domain: 'example.com',
path: '/',
},
userToken: {
name: 'croct.user_token',
maxAge: 31536000,
domain: 'example.com',
path: '/',
},
},
}))
app.mount('#app')
```
**Plug Next**
```bash
NEXT_PUBLIC_CROCT_APP_ID=APPLICATION_ID
CROCT_API_KEY=API_KEY
NEXT_PUBLIC_CROCT_USER_TOKEN_COOKIE_DOMAIN=example.com
```
**Plug Nuxt**
```ts
export default defineNuxtConfig({
modules: ['@croct/plug-nuxt'],
croct: {
appId: 'APPLICATION_ID',
cookie: {
clientId: {
domain: 'example.com',
},
userToken: {
domain: 'example.com',
},
},
},
})
```
Always set the `domain` to your **main domain** (e.g., `example.com`), even when configuring a subdomain. This is what scopes the cookie to the parent domain and makes it available everywhere.
## Try it out
Verify that the cookie is shared across subdomains:
1. **Open your first subdomain**
Navigate to one subdomain (for example, `www.example.com`) and open the browser dev tools. Check the `croct.id` cookie value under **Application > Cookies**.
2. **Open another subdomain**
Navigate to a different subdomain (for example, `app.example.com`) and check the same cookie.
3. **Compare the values**
If both subdomains show the same `croct.id` value, the integration is working correctly.
- [Identify users](/reference/sdk/javascript/data-collection): Learn how to identify users and enrich their profiles.
- [Secure user tokens](/explanation/application/signed-tokens): Learn how signed tokens protect user identity.