Per the docs
Similarly, you cannot skip consent (even for first-party applications) if
localhost
appears in any domain in the application’s Allowed Callback URLs setting (found in Dashboard > Applications > Settings). Make sure to update Allowed Callback URLs and the callback URL you configured in your application to match the updated domain-mapping.
Does this include 127.0.0.1?