Logging in locally required a tunnel, because the deployed client publishes its metadata for the authorization server to fetch, and that server cannot reach localhost. The spec's localhost exception removes the need: with a client_id of http://localhost?...the server synthesises the metadata from the client_id's own query parameters, so nothing is published and no signing key is used. getOAuthClient now picks between the public loopback client and the confidential deployed client from PUBLIC_BASE_URL alone. The redirect URI must be on 127.0.0.1/[::1] while the client_id stays http://localhost, so local docs now say to browse 127.0.0.1 rather than localhost. Verified against bsky.social: the login endpoint returns a loopback client_id and its sign-in page renders for it.