Success/Cancel must be public https (the API rejects http/localhost). Any public https URL works (e.g. webhook.site).