If an inactive Okta Application already exists and the Okta CLI creates an app with the same name (by default the directory name).
okta start (and likely okta apps create) will generate a configuration for the deactivated app.
Running the app, and attempting to login (via an OAuth redirect) will result in Okta showing a 400 error with no indication of what happened (on purpose, to prevent leaking data).
The solution may be to either warn the user. Possibly writing the config but then exiting with a non-zero exit status (or both).