I’m investigating this issue.
The JS throws an error, because the POST method for /user-api-key returns 403 and build_not_found_page method in the controller does not invoke the preload_anonymous_data method that stores preloaded value.
It’s not sure why the server responded 403 with <h1 class="title">Oops! That page is private.</h1> when I added auth_redirect param. I tried to use the same domain for callback URL (to verify cross-site scripting issue) and HTTPS protocol, but no luck.