Gitea ticks "Confidential Client" by default, which makes it demand a client
secret. Decap runs in the browser and authenticates with PKCE, so there is
nowhere to keep one — the login then fails after the authorize screen, which
reads like a Decap bug rather than a registration mistake.
Also spells out step 9 as commands, notes that the Client ID is published in
the site's JavaScript by design (so committing it is fine, but the placeholder
is what belongs in a resold copy), and records the two failure modes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NizVpJ2dwzCbjCrTLCjeHn
6890ff4153