https://github.com/gsuitedevs/apps-script-oauth2/blob/master/src/OAuth2.js#L67
return Utilities.formatString('https://script.google.com/macros/d/%s/usercallback', scriptId);
I think that calls to Utilities.formatString should simply be replaced by:
return 'https://script.google.com/macros/d/'+scriptId+'/usercallback';
Or, if we want to be really conservative:
return 'https://script.google.com/macros/d/'+encodeURIComponent(scriptId)+'/usercallback';