We use OAuth2 for identity.

We use first-party cookies for session management.

We use APIs and signed tokens (JWT) to federate across domains without leaking user data.

The ones hurt by the death of third-party cookies are ad tech parasites who refused to innovate imho...