Thanks for the quick & precise reply as per your usual, @ncw!
I confirm that selecting "External" and going on right ahead allowed me to get a new Client ID and Secret, which I then pasted into rclone config, and after going through (you are right, REALLY scary "unnaproved app" warning screen & 'hoops'), I was then able to allow rclone to get a new Token ID and everything is good now.
Perhaps we could update the documentation?
Cheers,
-- Durval.