What is the best way to authorize a WEB application through the API server?

Question

API

An API-oriented application has been deployed (the API-server has its own login and registration forms) and a frontend application.
1 - Now the frontend authorization is done using an API request ( oauth/token?grant_type=password ) using the client credentials method . The front application receives the token after sending the login and password and saves it in a cookie.
2 - I suppose that it is better to leave the authorization on the API server and, upon successful login, redirect the user with the token to the front (web.app.com?token=token) where the token will be written to the cookie.
3 - Perform authorization on the API server and set a token cookie for the web.app.com domain (frontend application) from it, then redirect the client to this domain?
How is it better?

Answer 1

get for mitm is always nicer than POST and cookie