Hey!
Just a heads up for other folks, i couldn't get the dev setup running by only setting the two required configuration settings (EXTERNAL_BASE and DPOP_NONCE_SEED) listed in the CONFIG.md.
Things did start working once i set two additional settings OAUTH_SIGNING_KEYS and ATPROTO_OAUTH_SIGNING_KEYS. I generated values per the instructions in ADMIN.md using goat.