you're not being sarcastic here?
callback urls are all localhost, there’s no domain to whitelist, just client names