Enter your full callback URL(s) in this field. This means you should be providing the entire path, such as https://mysite.com/oauth/callback. Do not use wildcards, and do not use only the domain.
The post calls out that wildcards aren't safe.
Later, the post offers an example that only shows a vulnerability of an arbitrary callback URL.
I wonder why a callback like
https://*.mysite.com/oauth/callback would be unsafe. It seems none of the OAuth provider supports it (e.g. Google and Facebook).