The Chrome documentation on content script communication recommends using window.postMessage in the sending code (here, the web page) and using window.addEventListener("message", ...) in the listening code (here, the content script of the Chrome extension, injected into the page). Technically, any kind of custom DOM event could also do this, but postMessage/message already has built-in support.
You should be able to lift the example code from the codes nearly verbatim:
Native web page:
// right after we get auth_token saved to a variable... window.postMessage({ auth_token: auth_token }, "http://www.mypagedomain.com");
(Make sure http://www.mypagedomain.com is changed to your actual protocol/domain.)
contentscript.js (in Chrome extension, listening)
window.addEventListener("message", function(event) { // We only accept messages from ourselves if (event.source != window) { return; } console.log("auth_token received: " + event.data.auth_token); }, false);
From inside the event listener, you could use message passing to pass the auth_token to your background page, if necessary.
EDIT:
Your manifest should include something like this (note the use of run_at below to inject the script before the page loads):
... "content_scripts": [ { "matches": ["http://www.mypagedomain.com/*"], "js": ["contentscript.js"], "run_at": "document_start" } ], ...