In the following example you will find a param that is called redirect_uri, 
that uri needs to be whitelisted from Octorate. So write 
development@octorate.com asking for add the page you can host on your website.

This step in mandatory to go in production, if you're still testing you can use
this endpoint

https://localhost/octobook/identity/oauth.xhtml?client_id=CLIENT_ID&redirect_uri=https%3A%2F%2Fwww.mycompany.com%2Foauth_end.html&state=something_crypted

For live you will need help from the octorate team

The reason behind whitelisting is security, we wants to make sure that 
"the code" param we will give you will be on the right page.