Thanks for your help Jake! for the pages within X2, i DO see "Protected field value", so, all good! in fact I had created the oauth2id as "other" instead of "web app", and I there was then no place to register the js-origin... so, I did that, and then, It worked only when I registered my domain name without the www at the start... do you think it matters? In any case, Thanks a lot!!!!! much appreciated!