Ah-ha! I think I’ve figured it out. I needed to change response_type to token instead of code. Chrome dev tools now shows an HTTP POST request to http://localhost/sessions/new and http://localhost/client_event/new, so now it’s simply a matter of getting my web service to receive it instead.