If you can’t use shared cookies, then you need something like oAuth. Ultimately there needs to be some sort of authentication token in the HTTP request/response

If you can’t use shared cookies, then you need something like oAuth. Ultimately there needs to be some sort of authentication token in the HTTP request/response. Where that token comes from is up to you, but it certainly should not come from the client.