How to protect a subdomain without authorization?

Question

PHP

Guys question. There is a certain CRM closed by authorization. And there is a second subdomain with another CRM 2. We want to remove authorization from CRM 2 so that it works from the first one. Logging directly into CRM2 is not provided. So far, in my thoughts, to the link leading to CRM 2, make a GET key and check in this CRM 2. If the key matches, then display the content. Also do a check for HTTP_REFERER.
How secure is this CRM2 protection? Maybe there is another simpler implementation?

Answer 1

Is session transfer no longer popular? Or have you abandoned the standard sessions?)

Answer 2

2 subdomains, and one session.
https://yandex.ru/search/?text=one%20session%20for...