>POST /oauth/token HTTP/1.1 : 400 : 127.0.0.1
By default only origin corresponding to the instance_uri configuration parameter is allowed. I guess I should allow 127.0.0.1 as well? Does request come from 127.0.0.1 when you run it as an onion service?