Setting a JSON web token from a secondary api as a secure cookie on WordPress

Seems odd to answer my own question, but in case it is of use to someone, this is the answer.

To make an ajax call to a plugin, and receive the response correctly you must register that endpoint with the plugin. This allows you to sidestep the protection WordPress is putting in your way. I’m not sure if links to YouTube are allowed/accepted on here, but there is an excellent video here. I will remove if this is considered bad practice.

php for plugin

add_action ( 'rest_api_init', 'add_callback_url_endpoint' );

function add_callback_url_endpoint(){
    register_rest_route(
    'my_route/',
    'receive_callback',
     array(
       'methods' => 'POST',
       'callback' => 'my_receive_callback'
        )
     );
  }


function my_receive_callback($request_data){
    $data = array();
    $params = $request_data -> get_params();
    $index = $params['index'];

if(isset($index)){
        $data = array(
'index' => $index,
'status' => 'OK'
);    
}else{
            $data = array(
'status' => 'Not OK'
}
   return $data;
}