update

2026-07-25 13:27:45 -05:00
parent 2045b32a01
commit df24f965da
2 changed files with 4 additions and 1 deletions
@@ -53,7 +53,9 @@ Create these separately:

 The OAuth client secret authenticates the portal to Gitea. The package token
 is used only server-side while proxying an authorized file. Neither value is
-returned to a technician or Proxmox host.
+returned to a technician or Proxmox host. The broker requests only Gitea's
+`read:user` OAuth scope, which it uses to confirm the signed-in username
+against `TAPM_ALLOWED_GITEA_USERS`.

 ## 4. Broker configuration