OK I was able to get this working. The problem was I had
security.oauth2.sso.loginPath=http://localhost:8080/authorization-code/callback
instead of
security.oauth2.sso.loginPath=/authorization-code/callback
Makes sense because obviously okta can’t reach me on localhost.