Correct permissions for oauth

I recently picked up where some other folks had failed in building and running shiftkey’s fork of github desktop in a flatpak. while it initially starts up just fine attempting to sign into a github account fails as after giving permission from the browser the app does not pick up the response. any idea on how to fix it? I’ve hit a stone wall with permissions. any ideas on how to solve this?

manifest and other files are at