How to properly pass authentication from one NextJS instance to another hosted in separate domain?

[arvilmena]

Hello!

How do you authenticate a user to another NextJS app using the same authentication?

So, we have a NextJS app hosted on say A.com all it really does is to serve a login page. For these I am currently using the AuthJS@beta as to support future version. We are using AWS Cognito provider. So far, the authJS works properly.
But now, what we want is after authentication, we would call the database or another API to get the current user role.
If the user is Teacher, we will redirect him to teacher.A.com hoping to keep his authentication as if he authenticated with his Cognito using the NextJS+AuthJS on this domain.

It sounded to me this is generally 3 step process

1. get the raw response from Cognito
2. pass the raw response to the other NextJS app using a "callback route" i.e, teacher.A.com/auth-accept
3. in teacher.A.com nextjs instance, consume the raw response and then authenticate (???)

It seems like I can get the RAW response from Cognito from the jwt callback:

    async jwt({ token, account }) {
      console.log({ token, account });
      if (account?.provider === 'cognito') {
        return { ...token, rawCognito: account }; // inject the rawCognito to the token
      }
      return token;
    }

and then from here, I can inject this rawCognito to the session using the session callback:

    async session({ session, token }) {
      if ((token as any)?.rawCognitoToken ?? null) {
        (session as any).rawCognitoToken = (token as any).rawCognitoToken;
      }
      return session;
    },

then from this, my A.com homepage route will:

1. save the raw response object in the database, which will return a pseudo session id
2. redirect the user to teacher.A.com/auth-accept?session-id={XXXX}&user-id={XXXX}

then on my teacher.A.com

From here, I am not sure how to proceed, beside from retrieving the raw cognito response based on the "pseudo session id"
I haven't seen any example where the RAW is directly consumed.

Or if there are other better way to do this?

Thank you very much!