Reading up on all these replies, it seems like nsecbunker (and OAuth) must be run self-custodially via personal home server (ex: Umbrel).