How to store an authentication token?

Hello, this is probably a simple question, but I just can't find a proper answer: How to store an authentication token? I usually use Supabase for authentication. My Outlook add-in works wonderfully in the Outlook desktop app but not in the browser. The problem is that Supabase sets the auth cookies with Same-Site: Lax. Since these become third-party cookies in the browser, they can't be read on the server side. Therefore, I adjusted the cookie options so that the auth cookies are set with Same-Site: none; Secure; Partitioned. This makes the auth flow work with Supabase in Chrome but not, for example, in Safari. But I don't want to focus on Supabase specifically, rather on how you store tokens in general. Since third-party cookies are not an option, I considered storing the session on the server side. I would associate the user with Office.auth.getAccessToken() and use it to call up the session. However, I've read that Office.auth.getAccessToken() also doesn't always work and that it needs a fallback solution. But what options are left? Should I store the auth token in local storage?