we do not allow cross domain redirect by default cause that can make phishing attacks "Easier". If you want to do this, what you should do is redirect to a route like

/redirect

post login, and on that route, further redirect the user to wherever you want. So when another domain navigates to the auth domain, you can make it first navigate to auth.myapp.com/login?redirectBack=https://xxz.com&nonce=somerandomstting Then on the

/login

route, you can save the redirectBack and none query params in session storage and redirect the the actual login screen of the auth sub domain with redirectToPath query param as

/redirect

. Then on the

/redirect

page, you check for if a session exists, and if it does, you read the value from session storage and redirect the user back based on the redirectBack value. The redirect can be something like

/https://xyz.com/callback?nonce=...&jwt=...

On the

/callback

page on xyz.com, you can check that the nonce is the same as what was sent when navigating to the auth domain, and then send the jwt to its backend. The backend verifies the jwt and creates a session on xyz.com