Whatever your code passes for the callback URL at runtime is what’s used. The code’s callback URL will override the application settings here on the developer website.
Soooo … I would guess your code still passes a localhost URL.
The best thing to do is write your code in a way that it works regardless of where it’s running. For example, I use the following code in Java to generate a callback URL:
StringBuffer callbackURL = request.getRequestURL();
int index = callbackURL.lastIndexOf("/");
callbackURL.replace(index, callbackURL.length(), "").append("/callback.jsp");
RequestToken twitterRequestToken = twitter.getOAuthRequestToken(callbackURL.toString());