It seems like the (community maintained) PhoneGap quickstart is out of date as using {redirect: false} (popup mode) on embedded lock requires a grant type that is no longer supported.
Note, I also get the error in browser as a SPA, so it’s not just a PhoneGap thing. {redirect: true} is working fine in browser but if I try {redirect: false} it fails.
I’ll have a look at the auth0-cordova package and the Ionic2+ quickstart. I was hoping for a JS only solution (no Cordova plugins) but it looks like that wont be an option now that embedded lock (with redirect: false) is no longer working.