Collection domain (DNS)

The Web SDK sends its collection through a subdomain of yours, collect.<your-domain>. The SDK itself is delivered as an approved private package bundled into your frontend. This is first-party collection. It is required for SDK collection: there is no shared domain as an automatic fallback, and without an active collection domain the SDK is not enabled for your application. Preparing DNS does not activate it. Each request must match your current verified collection host, one of your application’s allowed website origins under that domain, and the application key. There is no routing fallback to the API host or another company’s collector.

Request the domain preparation

Production status

Web SDK collection is deployed in production, in shadow mode, only through your company’s registered collection domain; its end-to-end operation from a customer page is still being measured. Your collection is accepted once this domain is verified and active for your application; publishing the records alone does not activate it. See production status.

In the console, open Início and complete Criar a aplicação (create the application) with your exact HTTPS website origins. Then, in Configurar a coleta web (configure web collection), choose the Origem registrada da aplicação (one of those origins) and enter your Domínio-base de coleta da sua empresa (owned base domain), such as yourcompany.com. The resulting collector is collect.yourcompany.com. The SDK then collects from every allowed origin of the application whose host is yourcompany.com or one of its subdomains, such as https://yourcompany.com, https://www.yourcompany.com and https://app.yourcompany.com; you edit that list later in Integração e saúde › Origens das páginas. See onboarding.

The platform then prepares the application-bound certificate, routing and ownership challenge by itself, with no request to FingerTrackID and no operator step. Your only action is to publish the three public DNS records it shows you and configure the approved collector in the application. Private infrastructure plans, cloud credentials and secret-manager access are not integration inputs.

Who acts: “Depende de você” and “Automático”

Every step of the setup progress in Início carries one of two labels:

• Depende de você (depends on you): the setup waits for something only you can do, such as publishing the DNS records or adjusting your CAA policy.
• Automático (automatic): the platform is doing the work; there is nothing for you to do. The step moves on by itself.

The step Confirmar o domínio de coleta (confirm the collection domain) goes through these states:

On screen	Label	What it means
Preparing the certificate and records	Automático	The platform is preparing the certificate and the DNS records for you.
Publish the three records	Depende de você	Publish the three records shown, exactly as they appear.
Records found, verifying	Automático	Your records were found; the platform is verifying the certificate and the collection route.
Records not found yet	Depende de você	Your records were not seen yet. Check your DNS and choose Verificar agora (check now); the values stay the same, so you do not change what you published.
New verification being prepared	Automático	The platform is preparing a new verification, with the same records. Nothing to change in your DNS.
CAA does not allow the certificate authority	Depende de você	Your domain’s CAA policy blocks the certificate. See CAA.
Re-checking the domain	Automático	The platform is checking the domain again. Nothing to do.
All records found, finishing	Automático	Every record shows Encontrado; the platform is finishing the verification and activating the domain. Nothing to do.
Paused by support	—	FingerTrackID support paused this step. Contact support to resume it.
Concluído	—	The collection domain is confirmed.

The step Definir a guarda dos dados (define data custody) is always Automático: the platform applies the managed retention to your application by itself: the data is kept for at least 10 years and none of it is deleted (retention). You never act on it.

If an automatic step does not move for 30 minutes, it shows Algo travou (something got stuck): contact FingerTrackID support with the request reference shown in Início. Waiting for your DNS records is never shown as stuck.

The records you publish

You publish two CNAME records and one TXT ownership record, all under collect.<your-domain>. The exact values appear in the setup progress of your application in the console as soon as they are ready, each with a copy button and whether the platform has already found it (Encontrado, Ainda não encontrado or Ainda não conferido). They are generated for your application and must not be guessed or copied from another customer.

Shown as	Type	Name	Value	Purpose
Endereço de coleta	CNAME	collect.<your-domain>	The FingerTrackID collection host, provided to you	Routes the SDK traffic to FingerTrackID
Validação do certificado	CNAME	_acme-challenge.collect.<your-domain> or _acme-challenge_<suffix>.collect.<your-domain> (exact name provided to you)	The certificate authorization target, provided to you	Authorizes issuing the TLS certificate for collect.<your-domain>
Prova de propriedade	TXT	_ftid-ownership.collect.<your-domain>	ftid-domain-verification-v1=…, provided to you	Proves that your company controls the domain

Example with a fictitious domain, yourcompany.com — the target values are placeholders:

collect.yourcompany.com.                          CNAME  <collection-host-provided>.
_acme-challenge_<suffix>.collect.yourcompany.com. CNAME  <authorization-target-provided>.
_ftid-ownership.collect.yourcompany.com.          TXT    "ftid-domain-verification-v1=<value-provided>"

Rules:

• Exactly one record per CNAME name. Exactly one CNAME at collect.<your-domain> and exactly one CNAME at the certificate authorization name; the verification fails if the name answers with more than one value or a different one. Do not create any other record type (A, AAAA, TXT) at the same name as a CNAME.
• DNS only, no proxy in front. Publish the CNAMEs as plain DNS records, without a proxy, CDN or WAF of yours between the browser and FingerTrackID. A proxied record does not answer as the expected CNAME, so the verification does not pass.
• Publish the records, then choose Verificar agora. There is no deadline for you to meet: the platform keeps checking by itself, and the button Verificar agora (check now) checks the records right away. If the platform’s verification needs renewing, the same click renews it with the same TXT value, so you never change your DNS. A value you reconstruct yourself is never accepted as ownership proof.
• CAA. If your domain publishes CAA records, they must allow the certificate authorities Google uses for managed certificates: add pki.goog and letsencrypt.org (for example 0 issue "pki.goog" and 0 issue "letsencrypt.org"). The platform retries by itself once the policy allows them. If no CAA record applies to collect.<your-domain>, there is nothing to do.

Cookies the collection host receives

collect.<your-domain> is a host under your own domain, so the browser sends it every cookie of your site whose scope covers it. A session cookie created with Domain=.<your-domain> (or for a parent of it) reaches the collection host on every SDK request, because the SDK calls it with credentials: "include".

• What FingerTrackID does with them: the collector reads the Cookie header only in memory, during the request, and uses only its own installation cookie (__Host-ftid_i). Every other cookie is discarded with the request: it is not written to logs, error monitoring, the stored collection or the database.
• Why credentials: "include": it is what lets the browser return the installation cookie, which is HttpOnly and restricted to the collection host, and which keeps device continuity between visits. Without it, collection still works but loses that continuity.
• What we recommend: keep your session cookies restricted to the host of your application (no Domain attribute, ideally with the __Host- prefix), so they never reach collect.<your-domain> or any other subdomain.

How to check

After publishing, check from any machine with dig (replace yourcompany.com with your domain):

dig +short CNAME collect.yourcompany.com
dig +short CNAME _acme-challenge_<suffix>.collect.yourcompany.com
dig +short TXT _ftid-ownership.collect.yourcompany.com
dig +short CAA collect.yourcompany.com
dig +short CAA yourcompany.com

Each CNAME command must return exactly one line, equal to the value you received (dig may add a trailing dot to the name). The TXT answer must contain the value you received, in quotes. An empty answer means the record has not propagated yet or was created under a different name. The CAA commands are an initial diagnostic. They do not prove that certificate issuance is authorized: the platform also checks aliases and the applicable parent-domain chain before activation, and shows a CAA problem in the setup progress.

Tip

Many DNS panels append the domain automatically. If the panel asks only for the “name”, type collect — not collect.yourcompany.com, which would become collect.yourcompany.com.yourcompany.com.

What happens next

1. The platform checks the three records by itself, from time to time. To check right after publishing, choose Verificar agora (check now): the button shows Verificando… and the page refreshes by itself until the check comes back, usually in under a minute. Each record then shows Encontrado (found) or Ainda não encontrado (not found yet). If something is still missing, fix it in your DNS and choose Verificar agora again (at most once a minute). When everything is found, the step moves to Automático while the certificate and the collection route are verified and the domain is activated.

2. With the domain confirmed and the data custody preset applied, the platform completes the remaining automatic steps and activates collection for the application, with no request to FingerTrackID.

3. Configurar a coleta web in Início then shows Concluída (done), and Integração e saúde (integration and health) shows the first-party domain as active. Past collection counts do not prove that today’s domain verification remains active (see the screen).

Once collection is active, continue with installing the Web SDK.