title: How to issue httpOnly cookie using google auth
body: <p>I have an API on <code>api.domain.com</code> which using local authentication issues a cookie if user authentication is a success.</p>
  <p>The code to demonstrate the logic is right below.</p>
  <pre><code>    ctx.cookies.set(&quot;token&quot;, token, {
        httpOnly: true,
        secure: true,
        maxAge: 1000 * 60 * 60 * 24 * 14, // 14 Day Age
        domain:&quot;domain.com&quot;,
      });
  </code></pre>
  <p>After that, the frontend which is hosted at <code>client.domain.com</code> can access that token such that it can be passed as an authorization bearer token, for that reason we all know, but I won't explain.</p>
  <p>Everything was working fine until I decided that I wanted to use external providers for authentication.</p>
  <p>I managed to integrate Github, and Google OAuth successfully and I can confirm that the authentication flow is flawless except that the httpOnly cookie isn't being issued therefore making it difficult to make requests to those authorized endpoints that require an authorization bearer token.</p>
  <p><strong>What I have tried</strong></p>
  <p>As above, with the domain option set to <code>domain.com</code> at first, <code>client.domain.com</code> secondly, <code>accounts.google.com</code> but no success up to now.</p>
  <p><strong>My question</strong></p>
  <p>How do I authenticate using these external providers such that my API <code>api.domain.com</code> can issue an httpOnly cookie
  which can be used for that useful purpose on the frontend on <code>client.domain.com</code> when making requests?</p>
  <p>Thanks in advance.</p>