Terminating authentication outside of magneto, with magneto?

Anybody about to give any advice about terminating authentication outside of normal magneto? I’d like to tie a few different systems together and handle authentication in a way that always me to make sure a customer is actually logged into “the system” without having to do something super hacky with cookies or something.

In the past I’ve generated bearer tokens with magneto and used those with external systems and then exchanged them for a “normal” login cookie for Magento FE, but it always felt a bit hacky.

Itd be nice to have a nice clean well designed way to handle this.

Thanks for any recs!!