When you grant access, it should redirect back to your callback page, correct? Is this the oob situation we were discussing earlier? No callback causes it to call itself again? With the DDoS issues lately I haven't had any time to fix the oob functionality. It's high on the list though.
I think oob is working okay. At least, I've been able to register and retrieve working credentials with it.