An unknown app or a redirect_uri outside its callback gets an error page and no redirect. Unknown scopes are dropped, and a request with none asks for no scope rather than every scope. The consent page reads the app's name, homepage and owner from GET /api/oauth-apps/authorize.