[{"data":1,"prerenderedAt":141},["ShallowReactive",2],{"doc:\u002Fdocs\u002Fhosted-subdomain":3},{"page":4,"toc":125,"updated":140},{"path":5,"title":6,"seoTitle":7,"description":8,"blocks":9},"\u002Fdocs\u002Fhosted-subdomain","Hosted subdomain","Hosted Subdomain: A Fallback When You Cannot Run a Proxy","For a site that can run no proxy: point one subdomain of yours at Fingerly with a CNAME, and the browser SDK posts to it. Weaker than a proxy, and why.",[10,13,18,23,62,65,84,87,94,97,118,120,123],{"type":11,"text":12},"p","A hosted subdomain is for a site that can run no proxy at all, such as a hosted shop or a page builder that lets you add a DNS record but no code on the server. You add one subdomain of your site, such as `k7.shop.example`, point it at Fingerly with a `CNAME`, and Fingerly serves the browser SDK's calls on it, at a random path.",{"type":14,"tone":15,"text":16,"title":17},"callout","warning","It is a fallback, not a proxy. Browser extensions cannot see through a CNAME, so most content blockers see only your own name. But DNS-level blockers, and extensions that resolve names, such as uBlock Origin on Firefox, follow the record to Fingerly and can block it there. A [proxy](\u002Fdocs\u002Fproxy-integrations) on your own host has nothing to follow: use one if you can.","Weaker than a proxy",{"type":19,"level":20,"text":21,"id":22},"heading",2,"Set up","set-up",{"type":24,"steps":25},"steps",[26,33,46,51],{"title":27,"blocks":28},"Add the subdomain",[29,31],{"type":11,"text":30},"In the dashboard, open **Integration > Proxy keys** and choose **Add subdomain** under **Hosted subdomain**. Enter a new name on your site that means nothing, such as `k7.shop.example`. Keep the random path it offers, or type your own.",{"type":11,"text":32},"The dashboard shows whether hosted subdomains are available on your deployment. Owners and admins manage them, as they do proxies.",{"title":34,"blocks":35},"Create the DNS record",[36,38],{"type":11,"text":37},"At your DNS host, create one `CNAME` from the subdomain to the target the dashboard shows. It prints the record for you:",{"type":39,"samples":40},"code",[41],{"label":42,"lang":43,"code":44,"check":45},"DNS","text","k7.shop.example.  CNAME  \u003Cthe target the dashboard shows>.",false,{"title":47,"blocks":48},"Wait for the certificate",[49],{"type":11,"text":50},"A certificate for the subdomain is issued automatically once the record resolves, usually within minutes. Fingerly checks every pending subdomain every 30 seconds; **Check now** in the subdomain's menu checks at once. The subdomain is served as soon as it is **Active**.",{"title":52,"blocks":53},"Point the browser SDK at it",[54,60],{"type":39,"samples":55},[56],{"label":57,"lang":58,"code":59},"fingerly.ts","ts","import { load } from '@fingerly\u002Fweb-js'\n\nconst fingerly = await load({\n  apiKey: 'fly_pk_production_…',\n  endpoints: 'https:\u002F\u002Fk7.shop.example\u002Fq3v8wz1p',   \u002F\u002F https:\u002F\u002F\u003Csubdomain>\u003Cpath>\n})",{"type":11,"text":61},"The full URL, the subdomain followed by its path. **Show setup** in the subdomain's menu prints this line with your own values.",{"type":19,"level":20,"text":63,"id":64},"Statuses","statuses",{"type":66,"columns":67,"rows":71},"table",[68,69,70],"Status","Meaning","What to do",[72,76,80],[73,74,75],"**Waiting for DNS** (`pending`)","The record does not resolve yet, or the certificate is still being issued.","Check the record at your DNS host. It is usually a few minutes after the record is in place.",[77,78,79],"**Active** (`active`)","The subdomain serves the browser SDK.","Nothing.",[81,82,83],"**Failed** (`failed`)","The certificate could not be issued. The dashboard shows the reason.","Fix what the reason says, then remove the subdomain and add it again.",{"type":19,"level":20,"text":85,"id":86},"Names","names",{"type":88,"items":89},"list",[90,91,92,93],"It must be a subdomain, such as `k7.shop.example`, never the domain itself: a `CNAME` cannot sit on `shop.example`.","Choose a label that means nothing. A new label containing a word blockers match is refused, such as `fp`, `metrics`, `tracking`, `analytics`, `telemetry`, `collect`, `events`, `pixel`, `beacon`, `ads`, `log`, `stats`, `sdk`, `visitor`, `fraud`, `device`, `bot`, `fingerprint` or `fingerly`: the same list as [proxy paths](\u002Freference\u002Fmanagement\u002Fproxy-keys#paths).","Each name can be added once, by one organization.","The path follows the rules of a proxy path, and is random unless you type one.",{"type":19,"level":20,"text":95,"id":96},"How it differs from a proxy","how-it-differs-from-a-proxy",{"type":66,"columns":98,"rows":101},[99,100,6],"","Proxy",[102,106,110,114],[103,104,105],"Runs on","Your own host, at one path","Fingerly, under a subdomain of yours",[107,108,109],"Proxy key","Yes, as a server secret","None. Fingerly terminates the connection, so it sees the visitor's address directly.",[111,112,113],"What blockers can follow","Nothing: the request never leaves your host from the browser's point of view","The `CNAME`, for DNS-level blockers and extensions that resolve names",[115,116,117],"Browser SDK `endpoints`","The path, such as `\u002Fk7x2qm4a`","The full URL, such as `https:\u002F\u002Fk7.shop.example\u002Fq3v8wz1p`",{"type":11,"text":119},"The public key's allowed origins stay your pages' origins, such as `https:\u002F\u002Fshop.example`, not the subdomain. Only the subdomain's own path is answered, only to `POST` and CORS preflights, and nothing in the response names Fingerly. The subdomain is tied to your organization, so a public key from another organization is refused on it.",{"type":19,"level":20,"text":121,"id":122},"Remove a subdomain","remove-a-subdomain",{"type":11,"text":124},"**Remove** in the subdomain's menu stops serving it at once and drops its certificate. Delete the `CNAME` at your DNS host afterwards. The [management API](\u002Freference\u002Fmanagement\u002Fhosted-domains) does all of this from code.",[126,127,130,132,134,136,137,138,139],{"id":22,"text":21,"level":20},{"id":128,"text":27,"level":129},"step-add-the-subdomain",3,{"id":131,"text":34,"level":129},"step-create-the-dns-record",{"id":133,"text":47,"level":129},"step-wait-for-the-certificate",{"id":135,"text":52,"level":129},"step-point-the-browser-sdk-at-it",{"id":64,"text":63,"level":20},{"id":86,"text":85,"level":20},{"id":96,"text":95,"level":20},{"id":122,"text":121,"level":20},"2026-09-25T18:31:31.000Z",1793630452852]