Ok, I got it to work with the 2-step process. It seems that either the tooltip is wrong or that there is a bug with that part of the plugin:
oauth2 callback user info paths: … Supported properties are name, username, email, email_verified and avatar.
The latter is not true. For the avatars to work, one needs to add a json endpoint for user details, check “Fetch user JSON for OAuth2” and fill the oauth2 json avatar path property.