REST API request between domain and subdomain

There are 2 sites example.com and sub.example.com. Both sites are on WordPress. The site sub.example.com has a personal account for users; the site example.com does not have an account. Data between sites is synchronized during any operations with credentials, including when logging into your account. There is a task to find out on the site example.com that the user is currently authorized on the site sub.example.com. I’m making a request via a custom REST API route, but wordpress returns 0 in response to wp_get_current_user(). As I understand it, you need to authorize the request. For authorization, I currently see this solution:

1. Make cookies available to example.com:

define('COOKIE_DOMAIN', '.example.com');
define('COOKIEPATH', '/');

2. On the site sub.example.com we place the code (not the best way) to issue a nonce code:

add_action('init', function() {
if (isset($_GET['secret_token']) && $_GET['secret_token'] === 'sdfus8689yhj3hlwiuhey98wyewhuiehiw8932y') {
echo wp_create_nonce( 'wp_rest' );
exit;
}
}

3. On example.com we request the nonce code in this way:

$cookies = $_COOKIE;
$response = wp_remote_get('https://sub.example.com/?secret_token=ksdfus8689yhj3hlwiuhey98wyewhuiehiw8932y', array(
'cookies' => $cookies,
));

And with the received nonce code we are already successfully executing the request.
I understand that this scheme is not very beautiful, but how safe is this scheme? Or is there a better solution?

Let me clarify right away that even with synchronization enabled, when logging into an account on sub.example.com, the user remains unauthorized on the example.com website.

This case is used but doesn’t work, user is not logged in example.com
https://wordpress.stackexchange.com/questions/130753/how-to-share-cookies-and-sessions-between-domain-and-subdomain