As part of an external app authentication flow, I create a token that is tied to a user account. When the user visits /page?token={token} I want to log the user in with the userId associated with the token, as if they have completed the auth flow (this is simplified, I know this sounds terribly insecure, bear with me)

I've been hacking away at this for hours and the only solution seems to be using the client-side signIn function, but I want to handle this on the backend only.

Basically I want to force a logged-in session to the current browser accessing the page. Is that possible?