callback urls are all localhost, there’s no domain to whitelist, just client names