I've now got my button in place, which when clicked opens a popup window (with an authorization url) which performs some oauth authentication via a web api controller. At the moment the access_token is being returned to the popup window in the body. I've been basing my work on the code here: https://github.com/umbraco/Umbraco.Cms.Integrations/blob/3878f36c07343a9ffb74c08ec5a136e3670d5424/src/Umbraco.Cms.Integrations.SEO.Semrush/App_Plugins/UmbracoCms.Integrations/SEO/Semrush/semrush.controller.js and added a window.addEventListener("message", function (event) { ..... } but it never seems to get hit?

Do you ever trigger a "message" event on the window? This code just adds the eventlistener, but if the event never occurs it wont run the code. If you are just doing a request for external data then you probably don't need to set an eventlistener, you can do a request and then in the response promise edit whatever needs editing?

Process is: 1) open popup window (with auth url) 2) login to 3rd party service (which then fires response to API controller callback method) 3) API controller exchanges the code for an access_token 4) API controller returns the access_token to the popup I dont seem to have anyway of issuing a "message" event as the controller is just returning an Ok(response.Content) response.

Having a bit of a hard time wrapping my head around what you're trying to do and how you're doing it 🙂