Instead, they authenticate using a common auth service (say, auth.google), which by virtue of being a single domain can persist shared cookies for all its consumers. This would yield a valid token (possibly a JWT) that the authenticating application can then use however it would like, including as a cookie on the application's own domain.
Whenever you go to a service that temporarily sends you to a different login domain (often just immediately redirection you back), this is why.
