We don't have OAuth client registration open at the moment so until that happens, pretty much, yeah.
Then I don't really know. Seems to me the obvious first step to debugging it is to try running it on a machine that isn't behind the same router in order to rule it out.
I'm also not a backend...