We have T59631: OAuth developers should be able to change some of the parameters they registered an application with instead of having to submit a new application for updating the callback URL and other details before approval (mainly so that when reviewers point out mistakes, they can be fixed without having to register a new app).

After approval is a lot more tricky - the user has consented to the use of their account by an app, should we be able to automatically extend that consent to what's potentially a different app? Or maybe there should be some sort of reauthentication process, but that's not straightforward (we don't store the callback URL in user acceptance records currently) and does not seem much different from registering a new app, just a little more convenient.

I'm a little skeptical about how well people would be able to predict domain wildcards. For flexibility in the part after the domain name, we already have the callback prefix option.