Our mobile app and chrome extension doesn’t have a secure backend so we opted for PKCE. PKCE is good and our mobile app and chrome extension that makes requests to our company API using access tokens granted via PKCE. And, we check validity of these tokens and decode them for information on the user.
But, we are wondering if its possible to create session based authentication between our main API and our other apps?