What do you mean by two systems? Two applications? Do they share a database?
I believe that the database of the system 2 , if it is independent, that is to say the system in which you do not log in, should receive the token in some way at the moment the user logs into the system 1, to allow access to the resource.
Examples
I will explain two possible cases:
- 2 applications with a common database.
- 2 applications with separate databases
Both cases have a common part. First, when the user logs in App1, a token is stored in a table of the BD to which App2 has access. An access URL to the App2 resource is generated in App1, which includes the token.
The token is for one use only, so it must be deleted or marked in some way when it is used and it will be renewed with each session start, and an expiration can also be established.
When using the generated URL, App2 extracts the token and checks against the DB to allow or not access the resource.
Case features 2: 2 applications with independent databases
The token is generated in App1, but must be stored in App2. For this you can access the App2 data DB from App1, or more commonly, be sent to App2 in some way, in which case upon receipt in App2, it is stored in your DB.
Case variant 2
It may be that the token is stored in the App1 DB. App2 must check the token to give access to the resource, so once the URL is used with the token, either make a query directly against the App1 DB or send the token in some way to App1 to be verified in this and be given an answer.