Is this dark magic? :) How does it do oauth without a domain? If you build an apk for Android how does the authentication step grant your app an oauth token?

Does it use a shared firebase server to grant access? If so, how is that secure between unrelated firebase apps?

I tried the demo but it didn't work when running file://.../index.html. The login buttons did nothing.