Are we talking jwt-style bearer tokens? They have their own issues. Better to have the auth server issue a single-use token that gets exchanged for a properly

Are we talking jwt-style bearer tokens? They have their own issues. Better to have the auth server issue a single-use token that gets exchanged for a properly scoped session cookie on the app (sub)domain. Edit: Of course, then you also need some sort on central session storage, to properly deal with logging out.