How do other web sites know to present only "my" data, even though they don't encode "my" user id in the URL?
that is the usual pattern with OAuth provided by: Facebook, Google, Amazon, Huawei, etc...
After you auth with them in a game like mine, they give you a social network id, which is a string. Noone else gets that str.
And then I (as game dev) use that str to id the user and when the user is visiting my for the 1st time, I give him a numeric id in my game. And an "auth" str generated by my game. Etc... it works ok.
