That would be OAuth - https://en.wikipedia.org/wiki/OAuth https://en.wikipedia.org/wiki/OAuth. It's a standard meant for system A to authenticate a user with s

That would be OAuth - https://en.wikipedia.org/wiki/OAuth https://en.wikipedia.org/wiki/OAuth. It's a standard meant for system A to authenticate a user with system B. Ever logged in to a website with your Google account, or seen those permission screens asking you if you want to allow a third party website to access your Google account? That's OAuth. Now, as to why many websites do this even when you login with credentials for that system (and not third party auth) - my guess is the system has separate teams for each subsystem, each hosted on different subdomains. In order to transfer auth state from one subdomain to another, you need something like OAuth since cross-domain cookies are forbidden by the browsers.