A developer wants to use cookies for authentication in a mobile app (not a browser). What is the standard approach for mobile API authentication instead?

• A.Mobile apps typically send the device ID in a custom header (an IMEI or Android ID) rather than cookies, because that value is unique per phone, and the server maps it to the account for each request in place of a token issued at login by the backend
• B.Mobile apps generally use HTTP Basic credentials (the username with the password) rather than cookies, since the operating system caches them for each host, and the client library resends them on each call to the API server of the backend after the first login
• C.Mobile apps typically use bearer tokens (JWT or opaque tokens) in the Authorization header rather than cookies, because mobile HTTP clients do not automatically manage cookies like browsers and the token must be explicitly attached to each request
• D.Mobile apps usually rely on client certificates (a certificate per install) in place of cookies, because TLS then identifies the user, and the token layer is skipped