There's non CORS issue if you control the client (an app). The login POST call on news.ycombinator.com is the API you need. If you want it as a website/in the

There's non CORS issue if you control the client (an app). The login POST call on news.ycombinator.com is the API you need. If you want it as a website/in the browser, then you can make an extension instead of an app (going to yoursite.com should request installing extension, or load the site if extension is present).