Consent returns the callback URL in JSON, so replay can fill {{oauth:code}} from $.data.redirect_to before the token request. Co-authored-by: Cursor <cursoragent@cursor.com>