Summary

Google's OAuth for Desktop App clients only accepts http://localhost redirects, not http://127.0.0.1. Using the IP literal causes a 400 Bad Request error during the authorization flow.

From Google's documentation:

For loopback IP redirect URIs, use localhost rather than the literal loopback IP address. [...] The 127.0.0.1 form is not supported for desktop app redirect URIs.

Changes

Three occurrences in src/auth.ts updated from 127.0.0.1 to localhost:

• server.listen(0, '127.0.0.1', ...) → server.listen(0, 'localhost', ...)
• http://127.0.0.1:${port} redirect URI → http://localhost:${port}
• new URL(req.url!, 'http://127.0.0.1:...') → new URL(req.url!, 'http://localhost:...')

Fixes #90