Thanks for the clarification. I think in that case, the SuperTokens model does not mesh well with what I'm trying to do.

w1.example.com

and

w2.example.com

are just static websites and are not aware of sessions or users. Netlify would provide the access control in front of these sites, but that depends on a valid JWT existing in the user's browser. I don't really want to manage additional services for login (which is part of the attraction of the JAMStack for me). Do you know of any SaaS that could handle the lifecycle of these JWTs? Okta and Auth-0 are both very enterprise-y, and overly complex.