Question: The banner at the top of <https://developers.google.com/identity/one-tap/web/overview> says that while we must be on the whitelist to deploy this on a production site, we can test it out on `localhost`. However, when I try this, I still get a `403 Forbidden` when including the embed script:

`<script defer src="https://smartlock.google.com/client"></script>`

I made sure that `http://localhost:8000` is on my list of "Authorized JavaScript origins" in my OAuth Credential.

Is it possible to test out Google One-tap on localhost?

Answer: 
In your "Authorized JavaScript origins", do not include the port (even though the help text says "If you're using a nonstandard port, you must include it in the origin URI."). Use `http://localhost`, not `http://localhost:8000`.
`HTTP403` means `Forbidden` - which is being covered in the [Common Issues](https://developers.google.com/identity/one-tap/web/troubleshooting#common_issues) ...

`window.location.origin` does not have any port, but only protocol & hostname.