Still not that clear to me. In what way does the user or app authenticate through this domain? This has to be a domain that we control? There's no default? How does anyone provide to the API that they are affiliated with this domain?

Well, it's an estimate based on a median. If that's a lie then there's a large pack of liars over at stats.stackexchange.com hehe