How to securely send message (jwt token) from Website to extension's content script/background?

Question

I want to securely send a message (jwt token) from my website to my extension's content script/background, but it seems like chrome.runtime is unavailable (i.e. chrome.runtime.sendMessage throws error) in the website's context.(not extension's context).

website

    // Send a message to the extension
    chrome.runtime.sendMessage(
      extensionId,
      { action: 'auth-token', data: token },
      (response) => {
        if (response.success) {
          // Authentication succeeded
          console.log('done');
        } else {
          // Authentication failed
          console.log('failed');
        }
      }
    );

extension background

  chrome.runtime.onMessageExternal.addListener(
    (message, sender, sendResponse) => {
      console.log('========> ', { message, sender });
    }
  );

extension manifest v3

  "externally_connectable": {
    "matches": ["*://my-website.com/*"]
  },

how to achieve this, any idea?