A developer wants to use cookies for authentication in a mobile app (not a browser). What is the standard approach for mobile API authentication instead?

• A.Mobile apps should use Basic auth for simplicity; sessionStorage persists across browser restarts, while localStorage is the variant cleared when the tab closes; cookies set by JavaScript live in a separate namespace from Set-Cookie headers, and the server never sees them; SameSite=None works without Secure on production sites; the Secure pairing is only a linter convention
• B.Cookies work identically on mobile apps with no differences
• C.Mobile apps typically use bearer tokens (JWT or opaque tokens) in the Authorization header rather than cookies, because mobile HTTP clients do not automatically manage cookies like browsers and the token must be explicitly attached to each request
• D.Mobile apps use the same Set-Cookie mechanism as browsers; cookies marked Secure are encrypted at rest by the browser with a per-site key, and disk theft cannot expose them; signed cookies prevent the client from reading their contents; only tampering with the server's copy is detectable; SameSite=Strict cookies are still sent on cross-site POST requests, since Strict only covers embedded images and iframes