In your configuration on orcid.org, you needed to specify valid redirect URIs to associate with you application token.
The URL where OJS was running the plugin didn’t match what you configured there. A common issue is only configuring an https endpoint with ORCID, but allowing http access to OJS as a source for the request.