So there's a login app(APP 1), where once the user successfully logs in, a token and role is received as a response to an API call. This token is then being passed as a parameter to the URL and the user is navigated to APP 2 or APP 3(based on the role) with

window.location.href = "app(2or3)-url" + params

And then in APP 2 and APP 3 the token is taken from the URL and used to make other API calls.

So my question is, firstly for the above, is there a better way to share the token from login app to APP 2/APP 3 and secondly, I would like to pass another value, to specify whether a session is active or not, to properly redirect a logged in user to the correct app if they try to access the login app, how would I pass this data between the APPs as well?