How do we do this like auth.example.org + app.example.org instead of auth.app.example.org

You can store the cookies on the top-level domain i.e. example.org which would cover all subdomains (auth.example.org + app.example.org). More information on how to manage cookie storage here: https://docs.descope.com/security-best-practices/crossite-cookies#example-1-specific-domain

we are planning to use Descope's Hosted UI in auth.example.org - hence cookies will be set to auth.example.org