There is a small stylistic error on the JavaScript SDK documentation page.

Your application must have the client side OAuth flow enabled, and must not have disabled the desktop application redirect uri disabled.

Note the redundant disabled. That paragraph should be more like this.

Your application must have the client side OAuth flow enabled, and must not have the desktop application redirect uri disabled.