> My understanding is that to use Facebook as an auth mechanism, you must use their SDK

Does anyone know more about this?

As far as I remember Facebook does support being and openid connect authentication provider so it should be theoretically possible without their SDK. But it might be that they put some practical restrictions in place to force usage of their API??