I am trying to authenticate the generic Forgejo CLI with CodeFloe:
fj -H codefloe.com auth login
The browser authentication completes successfully and displays:
Authenticated! Close this tab and head back to your terminal.
The terminal then fails with:
Error: api error: invalid empty client secret
This is not a problem with fj’s client implementation. fj is a generic Forgejo client and uses Forgejo’s standard public OAuth application flow with PKCE. The client does not send a client_secret, as expected for a public native client.
CodeFloe’s token endpoint is rejecting the request because the registered OAuth application appears to be configured as confidential. A direct request to the token endpoint returns:
{
"error": "unauthorized_client",
"error_description": "invalid empty client secret"
}
The current client ID is:
d8f0480c-cc0a-4cfc-8a16-4b88230d61d4
Could the CodeFloe administrators verify that this OAuth application is configured as a public PKCE client and that it allows the loopback redirect URI:
http://127.0.0.1:26218/
Forgejo’s documentation describes this public-client setup here:
The fix should be on the CodeFloe OAuth application registration: either convert the existing application to public PKCE or provide the correct public client ID.