What should I enter to the REDIRECT URL field?

This as for an example:

As we're still in sandbox mode, the redirect URL can be anything for now (e.g. https://www.google.com). Later on when we're live, your redirect url must be registered in the developer portal (illustrated above) and it must match the redirect_uri parameter. Please see the API authentication section of the documentation for more details and example.

httpbin is also widely used. So it really is up to you in the sandbox.

I don't understand how OAuth2 works 

For a nice tutorial about OAuth2, please check this link.