We have a website that uses a remote Laravel API app to store its data. Although the user appears to log into the website, it actually is authenticating to Laravel Passport on the remote Laravel app and then all data is requested on demand.
We would like to redirect the website user to the Laravel app on a web route, but without the user having to login again.
So what would be the most secure way to pass the user across, most likely using the bearer token, to the remote Laravel app and then authenticate the user based on that token ?