It seems that ArcGIS Online no longer permits you to use "localhost" as an Allowed Origin for CORS. So you cannot set https://localhost:3001 as an Allowed Origin, as required by Experience Builder.
The instructions in ArcGIS Experience Builder install, therefore, no longer work. When you get to Step #8 under "Create Client ID using ArcGIS Online or ArcGIS Enterprise", you cannot get past the error message, "Your application domain is not allowed via Cross-Origin Resource Sharing (CORS)..."

Instead of localhost, one has to set the fully-qualified domain name of their computer (e.g., http://mycomputer.mydomain:3001) as an Allowed Origin on your ArcGIS Online instance, and use it in place of https://localhost:3001 everywhere in the Experience Builder instructions.
Do the instructions need updating, or is there an easy way around this that I am missing?