I'm working with the oauth API right now, and it seems it doesn't support 'oob' for situations when you don't have a callback url available. If you could implement this, I'd be really grateful. All it needs to do is if there is no callback url, or the callback url is 'oob', just display a page with the token and verification information in it so the user can copy and paste it where they need it to go.
After doing more testing, it appears that with "oob" passed as the callback, the page uses itself as the callback URL with the verifier string in the URL as well. This would be fine except I think as soon as the page is loaded with the same token, it invalidates the old verifier, so I can't just copy the verifier from the URL and use it because it's already invalid

If you could make it show a new page that just displays the verifier string when the callback URL is "oob" that would be most excellent.
I'll definitely spend some time on this soon as I can. I've been looking a bit at some other implementations to see what the "right way" to implement it is.