I have multiple clients (GUIs) on localhost with different ports reaching to the same API which is also developed in the localhost. When port 8080 received an httpOnly cookie after a successful authentication, I got the same cookie in both port 8080 and 8081 - since this is the same domain.. This cookie is not usable, actually.. So I try to login from the 8081 client as well, but in addition, my port 8081 accesses my backend API through HTTPS tunnel (ngrok) and even when sending withCredentials:true the cookie won't get stored in this client cookies. So authentication doesn't work in the 8081 client.

How this process should be made? How can I develop a distributed system with many different clients (4 or 5 to be exact) securing the access token safely in an httpOnly cookie when working with proxies tunnels?