@jiangcaiyang ajax is just an HTTP request with JavaScript. If you just mimic the request (you can log a request with the chrome dev tools), it doesn't matter where the request is from, it should respond the same.
Now I just feel the need to create nodebb-plugin-rot26. BRB, trying to mock bcryptjs to provide genSalt and hash functions that do nothing and compare function that just compares two strings
I was able to successfully use twitter login. I think that I might also do the same for facebook where I have added callback URL and some token but facebook will ask for tax id.