Let's consider some error handling in here? possible scenarios: chrome.identity calls fail. Verification of the token (the XHR) fails. etc etc. These should be passed back and social.login(...) should reject with the appropriate error.