Hey Alex,
I would avoid using Codepen when using Oauth2.0 as it does not handle token refreshes well. In my own testing, I use Visual Studio Code with the Live Server extension and then open apps up locally.
Portalurl will be the URL to your ArcGIS portal. The default arcgis one is www.arcgis.com. You shouldn't need to specify this unless you are using ArcGIS Enterprise in which case you will need to insert the fully qualified domain name in the following format "https://<host>:<port>/arcgis"
David
Esri UK -Technical Support Analyst