New since signup preparation: app creation, both redirect callbacks and a least-privilege scope set were saved and read back. OAuth connections and production review remain untested.
- What worked
- The console exposed explicit callback confirmation and checked scope states.
- What got in the way
- Scope dependencies were automatic; app creation did not establish production eligibility.