Overview

CrowdTwist cookies are stored by the program member’s browser when that member has successfully authenticated with the CrowdTwist platform. A member can be authenticated through the User Authentication Sign In API (typically part of a SSO workflow) or by signing in through the CrowdTwist login widget (when CrowdTwist owns authentication). Widget content will not be displayed unless valid CrowdTwist cookies are present or the widget has a logged out state configuration to prompt for login/registration (when CrowdTwist owns authentication).

CrowdTwist cookies are removed from the member’s browser when that member is unauthenticated (either through the User Authentication Sign Out API or widget log out), the browser session is ended, or the cookie’s expiration date/time have passed. Expiration varies by cookie, see the table below for more information.

Cookie Details

The following cookies are used by the CrowdTwist platform:

Short Name	Description	Expiration	Sample Name
ctuc	User session (additional details below)	14 days (configurable)	prod_prod_ss_ctuc_2_15
ctut	User tracking (additional details below)	180 days	prod_sb_ss_ctut_2_15
cttg	Guest tracking (legacy Fan Center only)	Never	prod_sb_ss_cttg
ctlg	User language preference	Session	de_de_ss_ctlg_2_15
ctjr	User just registered (legacy Fan Center only)	365 days	prod_sb_ss_ctjr_2_15
ctnotif	User notifications (legacy Fan Center only)	Session	prod_sb_ss_ctnotif_2_15
ctcms	Control Center Authentication (Program Administrators Only)	15 minutes	de_de_ss_ctcms_2

Note: The expiration for the “ctuc” is configurable via CrowdTwist support. It is recommended that this be at least as long as your website authentication log out to ensure that a member does not end in a situation where he/she is authenticated to your site but is unable to see CrowdTwist widget content.

Naming Convention

Each CrowdTwist cookie is made of 5 parts: [DataCenter]_[Environment]_[SameSite]_[ShortName]_2_[InstanceID]

DataCenter: This is the CrowdTwist data center from which the cookie is generated. Options are:

• prod: CrowdTwist’s North America data center
• de: CrowdTwist’s European data center

Environment: This is the CrowdTwist environment from which the cookie is generated. Options are:

• prod: CrowdTwist’s North America production data center
• sb: CrowdTwist’s North America sandbox data center
• de: CrowdTwist’s European production data center

SameSite: This indicates that the Same Site attribute has been explicitly set to “None” (_ss_). Due to recent changes browser behavior, this attribute is required for cookies created on third-party-pages (i.e. client owned sites).

ShortName: This will be the Short Name from the Breakdown section above and detail which type of cookie is in use.

InstanceID: This is the unique identifier for CrowdTwist instance/program that issued the cookie.

Required Cookies

The “ctuc” and “ctut” cookies are both required for CrowdTwist widgets to properly. The “ctuc” cookie manages an authenticated member’s session and is required to load widget content. The “ctut” cookie tracks the member’s actions within the program and is used to award activities triggered by a CrowdTwist JavaScript tags.

Note: If these cookies are removed, members will not be able to load or interact with widget content and activities triggered by JavaScript tags will not be awarded.

Cookie Domains

For the browser to associate the cookie with the CrowdTwist widget the two must share the same URL (subdomain & root domain). It is recommended that the root domain for your CrowdTwist instance match that of the page where the widgets will be installed. For instance, you could use ct.company.com for your CrowdTwist instance (cookies and widgets) and then install the widgets on company.com. By ensuring these match (both the CrowdTwist URL and site URL are company.com) the content will be seen by the browser as first-party and not be blocked.

If your CrowdTwist instance does not share the same root domain as your site, contact your CrowdTwist representatives for setup details.