From d12ea701784ed11b37bbc81ff5e694685910b438 Mon Sep 17 00:00:00 2001
From: javery556 <128285906+javery556@users.noreply.github.com>
Date: Wed, 18 Mar 2026 22:32:55 +1100
Subject: [PATCH 1/3] feat: add Gitea account auth in integrations settings

---
 Cargo.lock                                    |  16 ++
 Cargo.toml                                    |   3 +
 .../src/components/GiteaAccountBadge.svelte   |  27 +++
 .../src/components/GiteaIntegration.svelte    | 173 ++++++++++++++++
 .../src/components/GiteaUserLoginState.svelte |  70 +++++++
 .../IntegrationsSettings.svelte               |   2 +
 apps/desktop/src/lib/bootstrap/deps.ts        |   3 +
 .../forge/gitea/giteaUserService.svelte.ts    | 121 +++++++++++
 .../lib/forge/gitea/giteaUserService.test.ts  |  38 ++++
 apps/desktop/src/lib/state/tags.ts            |   1 +
 crates/but-api/Cargo.toml                     |   1 +
 crates/but-api/src/gitea.rs                   |  54 +++++
 crates/but-api/src/lib.rs                     |   3 +
 crates/but-forge-storage/src/controller.rs    |  49 +++++
 crates/but-forge-storage/src/settings.rs      |  28 +++
 crates/but-gitea/Cargo.toml                   |  32 +++
 crates/but-gitea/src/client.rs                | 105 ++++++++++
 crates/but-gitea/src/lib.rs                   | 191 +++++++++++++++++
 crates/but-gitea/src/token.rs                 | 193 ++++++++++++++++++
 crates/but-server/src/lib.rs                  |  14 +-
 crates/gitbutler-tauri/src/main.rs            |   7 +-
 packages/core/src/generated/gitea/index.ts    |   5 +
 packages/core/src/generated/gitea/token.ts    |   3 +
 packages/core/src/generated/index.ts          |   2 +
 24 files changed, 1139 insertions(+), 2 deletions(-)
 create mode 100644 apps/desktop/src/components/GiteaAccountBadge.svelte
 create mode 100644 apps/desktop/src/components/GiteaIntegration.svelte
 create mode 100644 apps/desktop/src/components/GiteaUserLoginState.svelte
 create mode 100644 apps/desktop/src/lib/forge/gitea/giteaUserService.svelte.ts
 create mode 100644 apps/desktop/src/lib/forge/gitea/giteaUserService.test.ts
 create mode 100644 crates/but-api/src/gitea.rs
 create mode 100644 crates/but-gitea/Cargo.toml
 create mode 100644 crates/but-gitea/src/client.rs
 create mode 100644 crates/but-gitea/src/lib.rs
 create mode 100644 crates/but-gitea/src/token.rs
 create mode 100644 packages/core/src/generated/gitea/index.ts
 create mode 100644 packages/core/src/generated/gitea/token.ts

diff --git a/Cargo.lock b/Cargo.lock
index 4e2f1538958..f6670681541 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -881,6 +881,7 @@ dependencies = [
  "but-forge",
  "but-forge-storage",
  "but-gerrit",
+ "but-gitea",
  "but-github",
  "but-gitlab",
  "but-graph",
@@ -1207,6 +1208,21 @@ dependencies = [
  "snapbox",
 ]
 
+[[package]]
+name = "but-gitea"
+version = "0.0.0"
+dependencies = [
+ "anyhow",
+ "but-error",
+ "but-forge-storage",
+ "but-schemars",
+ "but-secret",
+ "reqwest 0.12.28",
+ "schemars 1.2.1",
+ "serde",
+ "ts-rs",
+]
+
 [[package]]
 name = "but-github"
 version = "0.0.0"
diff --git a/Cargo.toml b/Cargo.toml
index e263193e138..50f70af5250 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -67,6 +67,8 @@ members = [
     # 👉lacks top-level docs and docs.
     "crates/but-gitlab", # 📄A thin wrapper of the GitLab API, for authentication and resource access.
     # 👉No tests, lacks top-level docs, purpose somewhat unclear.
+    "crates/but-gitea", # 📄A thin wrapper of the Gitea API, for authentication and resource access.
+    # 👉No tests, lacks top-level docs, purpose somewhat unclear.
     "crates/but-cursor", # 📄Integration with Cursor
     # 👉Kind of no docs, no tests, and unclear purpose.
     "crates/but-forge", # 📄A generalised interface to communicate with forges.
@@ -174,6 +176,7 @@ but-cherry-apply = { path = "crates/but-cherry-apply" }
 but-irc = { path = "crates/but-irc" }
 but-github = { path = "crates/but-github" }
 but-gitlab = { path = "crates/but-gitlab" }
+but-gitea = { path = "crates/but-gitea" }
 but-error = { path = "crates/but-error" }
 but-serde = { path = "crates/but-serde" }
 but-schemars = { path = "crates/but-schemars" }
diff --git a/apps/desktop/src/components/GiteaAccountBadge.svelte b/apps/desktop/src/components/GiteaAccountBadge.svelte
new file mode 100644
index 00000000000..49bce4a609b
--- /dev/null
+++ b/apps/desktop/src/components/GiteaAccountBadge.svelte
@@ -0,0 +1,27 @@
+<script lang="ts">
+	import { Badge } from "@gitbutler/ui";
+	import type { ButGiteaToken } from "@gitbutler/core/api";
+
+	type Props = {
+		account: ButGiteaToken.GiteaAccountIdentifier;
+		class?: string;
+	};
+
+	const { account, class: className }: Props = $props();
+
+	function normalizedHost(host: string): string {
+		return host.replace(/^https?:\/\//, "").replace(/\/api\/v1\/?$/, "").replace(/\/$/, "");
+	}
+
+	export function badgeText(account: ButGiteaToken.GiteaAccountIdentifier): string {
+		return normalizedHost(account.host);
+	}
+
+	export function tooltipText(account: ButGiteaToken.GiteaAccountIdentifier): string {
+		return `Gitea instance: ${normalizedHost(account.host)}`;
+	}
+</script>
+
+<Badge class={className} tooltip={tooltipText(account)}>
+	{badgeText(account)}
+</Badge>
diff --git a/apps/desktop/src/components/GiteaIntegration.svelte b/apps/desktop/src/components/GiteaIntegration.svelte
new file mode 100644
index 00000000000..62a567cdbc8
--- /dev/null
+++ b/apps/desktop/src/components/GiteaIntegration.svelte
@@ -0,0 +1,173 @@
+<script lang="ts">
+	import GiteaUserLoginState from "$components/GiteaUserLoginState.svelte";
+	import ReduxResult from "$components/ReduxResult.svelte";
+	import { GITEA_USER_SERVICE } from "$lib/forge/gitea/giteaUserService.svelte";
+	import { inject } from "@gitbutler/core/context";
+	import { Button, CardGroup, Textbox } from "@gitbutler/ui";
+	import { fade } from "svelte/transition";
+
+	const giteaUserService = inject(GITEA_USER_SERVICE);
+
+	const [clearAll, clearingAllResult] = giteaUserService.deleteAllGiteaAccounts();
+	const [storeAccount, storeAccountResult] = giteaUserService.storeGiteaAccount;
+	const accounts = giteaUserService.accounts();
+
+	let showingFlow = $state(false);
+	let hostInput = $state<string>();
+	let patInput = $state<string>();
+	let hostError = $state<string>();
+	let patError = $state<string>();
+
+	function cleanupFlow() {
+		showingFlow = false;
+		hostInput = undefined;
+		patInput = undefined;
+		hostError = undefined;
+		patError = undefined;
+	}
+
+	function startFlow() {
+		showingFlow = true;
+	}
+
+	async function deleteAllGiteaAccounts() {
+		await clearAll();
+		startFlow();
+	}
+
+	async function storeToken() {
+		if (!hostInput || !patInput) return;
+		hostError = undefined;
+		patError = undefined;
+		try {
+			await storeAccount({ host: hostInput, accessToken: patInput });
+			cleanupFlow();
+		} catch (err: any) {
+			console.error("Failed to store Gitea token:", err);
+			hostError = "Invalid host or network error";
+			patError = "Invalid token";
+		}
+	}
+</script>
+
+<div class="stack-v gap-8">
+	<CardGroup>
+		<ReduxResult result={accounts.result}>
+			{#snippet error()}
+				<CardGroup.Item>
+					{#snippet title()}
+						Failed to load Gitea accounts
+					{/snippet}
+					<Button
+						style="pop"
+						onclick={deleteAllGiteaAccounts}
+						loading={clearingAllResult.current.isLoading}>Try again</Button
+					>
+				</CardGroup.Item>
+			{/snippet}
+
+			{#snippet children(accounts)}
+				{@const noAccounts = accounts.length === 0}
+				{#each accounts as account}
+					<GiteaUserLoginState {account} />
+				{/each}
+
+				<CardGroup.Item background={accounts.length > 0 ? "var(--clr-bg-2)" : undefined}>
+					{#snippet iconSide()}
+						<div class="icon-wrapper__logo">GT</div>
+					{/snippet}
+
+					{#snippet title()}
+						Gitea
+					{/snippet}
+
+					{#snippet caption()}
+						Store a personal access token for Codeberg or any Gitea-compatible instance.
+					{/snippet}
+
+					{#snippet actions()}
+						<Button
+							style="pop"
+							onclick={startFlow}
+							disabled={showingFlow}
+							loading={storeAccountResult.current.isLoading}
+						>
+							{noAccounts ? "Add account" : "Add another"}
+						</Button>
+					{/snippet}
+				</CardGroup.Item>
+			{/snippet}
+		</ReduxResult>
+	</CardGroup>
+
+	{#if showingFlow}
+		<div in:fade={{ duration: 100 }}>
+			<CardGroup>
+				<CardGroup.Item>
+					{#snippet title()}
+						Add Gitea Account
+					{/snippet}
+
+					{#snippet caption()}
+						Use the web base URL for your instance, such as `https://codeberg.org` or your
+						self-hosted Gitea host.
+					{/snippet}
+
+					<Textbox
+						label="Instance URL"
+						size="large"
+						value={hostInput}
+						oninput={(value) => (hostInput = value)}
+						placeholder="https://codeberg.org"
+						error={hostError}
+					/>
+					<Textbox
+						label="Personal Access Token"
+						size="large"
+						type="password"
+						value={patInput}
+						oninput={(value) => (patInput = value)}
+						error={patError}
+					/>
+				</CardGroup.Item>
+				<CardGroup.Item>
+					<div class="flex justify-end gap-6">
+						<Button style="gray" kind="outline" onclick={cleanupFlow}>Cancel</Button>
+						<Button
+							style="pop"
+							disabled={!hostInput || !patInput}
+							loading={storeAccountResult.current.isLoading}
+							onclick={storeToken}
+						>
+							Add account
+						</Button>
+					</div>
+				</CardGroup.Item>
+			</CardGroup>
+		</div>
+	{/if}
+</div>
+
+<p class="text-12 text-body integration-settings__text">
+	🔒 Credentials are persisted locally in your OS Keychain / Credential Manager.
+</p>
+
+<style lang="postcss">
+	.icon-wrapper__logo {
+		display: flex;
+		width: 28px;
+		height: 28px;
+		align-items: center;
+		justify-content: center;
+		border-radius: 999px;
+		background: var(--clr-bg-3);
+		color: var(--clr-text-1);
+		font-size: 11px;
+		font-weight: 700;
+		letter-spacing: 0.08em;
+	}
+
+	.integration-settings__text {
+		color: var(--clr-text-2);
+	}
+</style>
diff --git a/apps/desktop/src/components/GiteaUserLoginState.svelte b/apps/desktop/src/components/GiteaUserLoginState.svelte
new file mode 100644
index 00000000000..7306e74ae82
--- /dev/null
+++ b/apps/desktop/src/components/GiteaUserLoginState.svelte
@@ -0,0 +1,70 @@
+<script lang="ts">
+	import GiteaAccountBadge from "$components/GiteaAccountBadge.svelte";
+	import ReduxResult from "$components/ReduxResult.svelte";
+	import { GITEA_USER_SERVICE } from "$lib/forge/gitea/giteaUserService.svelte";
+	import { inject } from "@gitbutler/core/context";
+	import { ForgeUserCard } from "@gitbutler/ui";
+	import { QueryStatus } from "@reduxjs/toolkit/query";
+	import type { ButGiteaToken } from "@gitbutler/core/api";
+
+	type Props = {
+		account: ButGiteaToken.GiteaAccountIdentifier;
+	};
+
+	const { account }: Props = $props();
+
+	const giteaUserService = inject(GITEA_USER_SERVICE);
+
+	const [forget, forgetting] = giteaUserService.forgetGiteaAccount;
+	const giteaUser = $derived(giteaUserService.authenticatedUser(account));
+
+	const isError = $derived(giteaUser.result?.status === QueryStatus.rejected);
+	const isLoading = $derived(giteaUser.result?.status === QueryStatus.pending);
+	const username = $derived(account.username);
+</script>
+
+<ReduxResult result={giteaUser.result}>
+	{#snippet loading()}
+		<ForgeUserCard
+			{username}
+			avatarUrl={null}
+			isError={false}
+			isLoading={true}
+			onForget={() => forget(account)}
+			isForgetLoading={forgetting.current.isLoading}
+		>
+			{#snippet badge()}
+				<GiteaAccountBadge {account} />
+			{/snippet}
+		</ForgeUserCard>
+	{/snippet}
+	{#snippet error()}
+		<ForgeUserCard
+			{username}
+			avatarUrl={null}
+			isError={true}
+			isLoading={false}
+			onForget={() => forget(account)}
+			isForgetLoading={forgetting.current.isLoading}
+		>
+			{#snippet badge()}
+				<GiteaAccountBadge {account} />
+			{/snippet}
+		</ForgeUserCard>
+	{/snippet}
+	{#snippet children(user)}
+		<ForgeUserCard
+			{username}
+			avatarUrl={user?.avatarUrl ?? null}
+			email={user?.email}
+			{isError}
+			{isLoading}
+			onForget={() => forget(account)}
+			isForgetLoading={forgetting.current.isLoading}
+		>
+			{#snippet badge()}
+				<GiteaAccountBadge {account} />
+			{/snippet}
+		</ForgeUserCard>
+	{/snippet}
+</ReduxResult>
diff --git a/apps/desktop/src/components/profileSettings/IntegrationsSettings.svelte b/apps/desktop/src/components/profileSettings/IntegrationsSettings.svelte
index 5460515859e..9e5923a91e9 100644
--- a/apps/desktop/src/components/profileSettings/IntegrationsSettings.svelte
+++ b/apps/desktop/src/components/profileSettings/IntegrationsSettings.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import GiteaIntegration from "$components/GiteaIntegration.svelte";
 	import GithubIntegration from "$components/GithubIntegration.svelte";
 	import GitlabIntegration from "$components/GitlabIntegration.svelte";
 	import { SETTINGS_SERVICE } from "$lib/config/appSettingsV2";
@@ -17,6 +18,7 @@
 
 <GithubIntegration />
 <GitlabIntegration />
+<GiteaIntegration />
 <Spacer />
 <CardGroup>
 	<CardGroup.Item labelFor="autoFillPrDescription">
diff --git a/apps/desktop/src/lib/bootstrap/deps.ts b/apps/desktop/src/lib/bootstrap/deps.ts
index 25b2e39e4e3..aff92d16464 100644
--- a/apps/desktop/src/lib/bootstrap/deps.ts
+++ b/apps/desktop/src/lib/bootstrap/deps.ts
@@ -25,6 +25,7 @@ import {
 } from "$lib/dragging/stackingReorderDropzoneManager";
 import { FILE_SERVICE, FileService } from "$lib/files/fileService";
 import { DefaultForgeFactory, DEFAULT_FORGE_FACTORY } from "$lib/forge/forgeFactory.svelte";
+import { GITEA_USER_SERVICE, GiteaUserService } from "$lib/forge/gitea/giteaUserService.svelte";
 import { GITHUB_CLIENT, GitHubClient } from "$lib/forge/github/githubClient";
 import { GitHubUserService, GITHUB_USER_SERVICE } from "$lib/forge/github/githubUserService.svelte";
 import { GITLAB_CLIENT, GitLabClient } from "$lib/forge/gitlab/gitlabClient.svelte";
@@ -137,6 +138,7 @@ export function initDependencies(args: {
 
 	const clientState = new ClientState(backend, gitHubClient, gitLabClient, posthog);
 	const githubUserService = new GitHubUserService(clientState.backendApi);
+	const giteaUserService = new GiteaUserService(clientState.backendApi);
 	const gitlabUserService = new GitLabUserService(clientState.backendApi, secretsService);
 
 	const uiState = new UiState(
@@ -346,6 +348,7 @@ export function initDependencies(args: {
 		[FOCUS_MANAGER, focusManager],
 		[GITHUB_CLIENT, gitHubClient],
 		[GITHUB_USER_SERVICE, githubUserService],
+		[GITEA_USER_SERVICE, giteaUserService],
 		[GITLAB_USER_SERVICE, gitlabUserService],
 		[GITLAB_CLIENT, gitLabClient],
 		[GIT_CONFIG_SERVICE, gitConfig],
diff --git a/apps/desktop/src/lib/forge/gitea/giteaUserService.svelte.ts b/apps/desktop/src/lib/forge/gitea/giteaUserService.svelte.ts
new file mode 100644
index 00000000000..40dbf340419
--- /dev/null
+++ b/apps/desktop/src/lib/forge/gitea/giteaUserService.svelte.ts
@@ -0,0 +1,121 @@
+import { providesItem, providesList, ReduxTag } from "$lib/state/tags";
+import { InjectionToken } from "@gitbutler/core/context";
+import type { BackendApi } from "$lib/state/clientState.svelte";
+import type { ButGitea, ButGiteaToken } from "@gitbutler/core/api";
+
+export const GITEA_USER_SERVICE = new InjectionToken<GiteaUserService>("GiteaUserService");
+
+export function isSameGiteaAccountIdentifier(
+	a: ButGiteaToken.GiteaAccountIdentifier,
+	b: ButGiteaToken.GiteaAccountIdentifier,
+): boolean {
+	return a.host === b.host && a.username === b.username;
+}
+
+const UNIT_SEP = "\u001F";
+
+export function giteaAccountIdentifierToString(
+	account: ButGiteaToken.GiteaAccountIdentifier,
+): string {
+	return `${account.host}${UNIT_SEP}${account.username}`;
+}
+
+export function stringToGiteaAccountIdentifier(
+	str: string,
+): ButGiteaToken.GiteaAccountIdentifier | null {
+	const parts = str.split(UNIT_SEP);
+	if (parts.length !== 2) {
+		return null;
+	}
+
+	return {
+		host: parts[0]!,
+		username: parts[1]!,
+	};
+}
+
+export class GiteaUserService {
+	private backendApi: ReturnType<typeof injectBackendEndpoints>;
+
+	constructor(backendApi: BackendApi) {
+		this.backendApi = injectBackendEndpoints(backendApi);
+	}
+
+	get storeGiteaAccount() {
+		return this.backendApi.endpoints.storeGiteaAccount.useMutation();
+	}
+
+	get forgetGiteaAccount() {
+		return this.backendApi.endpoints.forgetGiteaAccount.useMutation();
+	}
+
+	authenticatedUser(account: ButGiteaToken.GiteaAccountIdentifier) {
+		return this.backendApi.endpoints.getGiteaUser.useQuery({ account });
+	}
+
+	accounts() {
+		return this.backendApi.endpoints.listKnownGiteaAccounts.useQuery();
+	}
+
+	deleteAllGiteaAccounts() {
+		return this.backendApi.endpoints.clearAllGiteaAccounts.useMutation();
+	}
+}
+
+function injectBackendEndpoints(api: BackendApi) {
+	return api.injectEndpoints({
+		endpoints: (build) => ({
+			forgetGiteaAccount: build.mutation<void, ButGiteaToken.GiteaAccountIdentifier>({
+				extraOptions: {
+					command: "forget_gitea_account",
+					actionName: "Forget Gitea Account",
+				},
+				query: (account) => ({
+					account,
+				}),
+				invalidatesTags: [providesList(ReduxTag.GiteaUserList)],
+			}),
+			getGiteaUser: build.query<
+				ButGitea.AuthenticatedUserSensitive | null,
+				{ account: ButGiteaToken.GiteaAccountIdentifier }
+			>({
+				extraOptions: {
+					command: "get_gitea_user",
+				},
+				query: (args) => args,
+				providesTags: (_result, _error, { account }) => [
+					...providesItem(
+						ReduxTag.ForgeUser,
+						`gitea:${account.host}:${account.username}`,
+					),
+				],
+			}),
+			listKnownGiteaAccounts: build.query<ButGiteaToken.GiteaAccountIdentifier[], void>({
+				extraOptions: {
+					command: "list_known_gitea_accounts",
+				},
+				query: () => ({}),
+				providesTags: [providesList(ReduxTag.GiteaUserList)],
+			}),
+			clearAllGiteaAccounts: build.mutation<void, void>({
+				extraOptions: {
+					command: "clear_all_gitea_tokens",
+					actionName: "Clear All Gitea Accounts",
+				},
+				query: () => ({}),
+				invalidatesTags: [providesList(ReduxTag.GiteaUserList)],
+			}),
+			storeGiteaAccount: build.mutation<
+				ButGitea.AuthStatusResponseSensitive,
+				{ host: string; accessToken: string }
+			>({
+				extraOptions: {
+					command: "store_gitea_account",
+					actionName: "Store Gitea Account",
+				},
+				query: (args) => args,
+				invalidatesTags: [providesList(ReduxTag.GiteaUserList)],
+			}),
+		}),
+	});
+}
diff --git a/apps/desktop/src/lib/forge/gitea/giteaUserService.test.ts b/apps/desktop/src/lib/forge/gitea/giteaUserService.test.ts
new file mode 100644
index 00000000000..edf2a3d5e26
--- /dev/null
+++ b/apps/desktop/src/lib/forge/gitea/giteaUserService.test.ts
@@ -0,0 +1,38 @@
+import {
+	giteaAccountIdentifierToString,
+	isSameGiteaAccountIdentifier,
+	stringToGiteaAccountIdentifier,
+} from "$lib/forge/gitea/giteaUserService.svelte";
+import { describe, expect, test } from "vitest";
+
+describe("giteaUserService helpers", () => {
+	test("round-trips account identifiers", () => {
+		const account = {
+			host: "https://codeberg.org",
+			username: "alice",
+		};
+
+		expect(stringToGiteaAccountIdentifier(giteaAccountIdentifierToString(account))).toEqual(
+			account,
+		);
+	});
+
+	test("rejects malformed serialized identifiers", () => {
+		expect(stringToGiteaAccountIdentifier("not-a-valid-account")).toBeNull();
+	});
+
+	test("compares host and username", () => {
+		expect(
+			isSameGiteaAccountIdentifier(
+				{ host: "https://codeberg.org", username: "alice" },
+				{ host: "https://codeberg.org", username: "alice" },
+			),
+		).toBe(true);
+		expect(
+			isSameGiteaAccountIdentifier(
+				{ host: "https://codeberg.org", username: "alice" },
+				{ host: "https://codeberg.org", username: "bob" },
+			),
+		).toBe(false);
+	});
+});
diff --git a/apps/desktop/src/lib/state/tags.ts b/apps/desktop/src/lib/state/tags.ts
index 1069f56f9fb..6889aaa724e 100644
--- a/apps/desktop/src/lib/state/tags.ts
+++ b/apps/desktop/src/lib/state/tags.ts
@@ -15,6 +15,7 @@ export enum ReduxTag {
 	BranchChanges = "BranchChanges",
 	ForgeUser = "ForgeUser",
 	GitHubUserList = "GitHubUserList",
+	GiteaUserList = "GiteaUserList",
 	GitLabUserList = "GitLabUserList",
 	PullRequests = "PullRequests",
 	GitlabMRs = "GitlabMRs",
diff --git a/crates/but-api/Cargo.toml b/crates/but-api/Cargo.toml
index 738b37d67af..b1ae9d1a734 100644
--- a/crates/but-api/Cargo.toml
+++ b/crates/but-api/Cargo.toml
@@ -91,6 +91,7 @@ but-hunk-assignment.workspace = true
 but-hunk-dependency.workspace = true
 but-github.workspace = true
 but-gitlab.workspace = true
+but-gitea.workspace = true
 # 'legacy' is needed while this is only a sketch of what the oplog could be.
 # For single-branch testing, we also want the oplog and just take it as it is.
 but-oplog = { workspace = true, features = ["legacy"] }
diff --git a/crates/but-api/src/gitea.rs b/crates/but-api/src/gitea.rs
new file mode 100644
index 00000000000..ea3d4707793
--- /dev/null
+++ b/crates/but-api/src/gitea.rs
@@ -0,0 +1,54 @@
+use anyhow::Result;
+use but_api_macros::but_api;
+use but_gitea::{AuthStatusResponse, AuthenticatedUser, json};
+use but_secret::Sensitive;
+use tracing::instrument;
+
+/// Stores a Gitea access token for a given instance host.
+///
+/// Validates and stores the provided access token, then retrieves and returns the authenticated
+/// user information for the configured Gitea-compatible host.
+#[but_api(json::AuthStatusResponseSensitive)]
+#[instrument(err(Debug))]
+pub async fn store_gitea_account(
+    access_token: Sensitive<String>,
+    host: String,
+) -> Result<AuthStatusResponse> {
+    let storage = but_forge_storage::Controller::from_path(but_path::app_data_dir()?);
+    but_gitea::store_account(&host, &access_token, &storage).await
+}
+
+/// Removes stored credentials for a specific Gitea account.
+#[but_api]
+#[instrument(err(Debug))]
+pub fn forget_gitea_account(account: but_gitea::GiteaAccountIdentifier) -> Result<()> {
+    let storage = but_forge_storage::Controller::from_path(but_path::app_data_dir()?);
+    but_gitea::forget_gitea_access_token(&account, &storage).ok();
+    Ok(())
+}
+
+/// Removes all stored Gitea credentials.
+#[but_api]
+#[instrument(err(Debug))]
+pub fn clear_all_gitea_tokens() -> Result<()> {
+    let storage = but_forge_storage::Controller::from_path(but_path::app_data_dir()?);
+    but_gitea::clear_all_gitea_tokens(&storage)
+}
+
+/// Retrieves the authenticated user information for a Gitea account.
+#[but_api(json::AuthenticatedUserSensitive)]
+#[instrument(err(Debug))]
+pub async fn get_gitea_user(
+    account: but_gitea::GiteaAccountIdentifier,
+) -> Result<Option<AuthenticatedUser>> {
+    let storage = but_forge_storage::Controller::from_path(but_path::app_data_dir()?);
+    but_gitea::get_gitea_user(&account, &storage).await
+}
+
+/// Lists all Gitea accounts with stored credentials.
+#[but_api]
+#[instrument(err(Debug))]
+pub fn list_known_gitea_accounts() -> Result<Vec<but_gitea::GiteaAccountIdentifier>> {
+    let storage = but_forge_storage::Controller::from_path(but_path::app_data_dir()?);
+    but_gitea::list_known_gitea_accounts(&storage)
+}
diff --git a/crates/but-api/src/lib.rs b/crates/but-api/src/lib.rs
index 4df142ea6a5..baea902ec20 100644
--- a/crates/but-api/src/lib.rs
+++ b/crates/but-api/src/lib.rs
@@ -18,6 +18,9 @@ pub mod github;
 /// Functions for GitLab authentication.
 pub mod gitlab;
 
+/// Functions for Gitea authentication.
+pub mod gitea;
+
 /// Functions that take a branch as input.
 pub mod branch;
 
diff --git a/crates/but-forge-storage/src/controller.rs b/crates/but-forge-storage/src/controller.rs
index 64171f41595..45e84d73671 100644
--- a/crates/but-forge-storage/src/controller.rs
+++ b/crates/but-forge-storage/src/controller.rs
@@ -113,6 +113,55 @@ impl Controller {
         self.save_settings(&settings)
     }
 
+    /// Get all known Gitea accounts.
+    pub fn gitea_accounts(&self) -> anyhow::Result<Vec<crate::settings::GiteaAccount>> {
+        let settings = self.read_settings()?;
+        Ok(settings.gitea.known_accounts)
+    }
+
+    /// Add a Gitea account if it does not already exist.
+    pub fn add_gitea_account(
+        &self,
+        account: &crate::settings::GiteaAccount,
+    ) -> anyhow::Result<()> {
+        let mut settings = self.read_settings()?;
+
+        if settings.gitea.known_accounts.iter().any(|a| a == account) {
+            return Ok(());
+        }
+
+        settings.gitea.known_accounts.push(account.to_owned());
+        self.save_settings(&settings)
+    }
+
+    /// Clear all Gitea accounts.
+    /// Returns the list of access token keys that should be deleted.
+    pub fn clear_all_gitea_accounts(&self) -> anyhow::Result<Vec<String>> {
+        let mut settings = self.read_settings()?;
+        let access_tokens_to_delete = settings
+            .gitea
+            .known_accounts
+            .iter()
+            .map(|account| account.access_token_key().to_string())
+            .collect::<Vec<String>>();
+        settings.gitea.known_accounts.clear();
+        self.save_settings(&settings)?;
+
+        Ok(access_tokens_to_delete)
+    }
+
+    /// Remove a Gitea account.
+    pub fn remove_gitea_account(
+        &self,
+        account: &crate::settings::GiteaAccount,
+    ) -> anyhow::Result<()> {
+        let mut settings = self.read_settings()?;
+
+        settings.gitea.known_accounts.retain(|a| a != account);
+
+        self.save_settings(&settings)
+    }
+
     fn read_settings(&self) -> anyhow::Result<crate::settings::ForgeSettings> {
         self.settings_storage.read()
     }
diff --git a/crates/but-forge-storage/src/settings.rs b/crates/but-forge-storage/src/settings.rs
index 1196f69226e..52ef28ecaef 100644
--- a/crates/but-forge-storage/src/settings.rs
+++ b/crates/but-forge-storage/src/settings.rs
@@ -8,6 +8,9 @@ pub struct ForgeSettings {
     /// GitLab-specific settings.
     #[serde(default)]
     pub gitlab: GitLabSettings,
+    /// Gitea-specific settings.
+    #[serde(default)]
+    pub gitea: GiteaSettings,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, Default)]
@@ -187,3 +190,28 @@ impl PartialEq for GitLabAccount {
         }
     }
 }
+
+#[derive(Clone, Debug, Serialize, Deserialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct GiteaSettings {
+    /// Gitea-specific settings.
+    pub known_accounts: Vec<GiteaAccount>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct GiteaAccount {
+    pub host: String,
+    pub username: String,
+    pub access_token_key: String,
+}
+
+impl GiteaAccount {
+    pub fn access_token_key(&self) -> &str {
+        &self.access_token_key
+    }
+
+    pub fn username(&self) -> &str {
+        &self.username
+    }
+}
diff --git a/crates/but-gitea/Cargo.toml b/crates/but-gitea/Cargo.toml
new file mode 100644
index 00000000000..7194787baf0
--- /dev/null
+++ b/crates/but-gitea/Cargo.toml
@@ -0,0 +1,32 @@
+[package]
+name = "but-gitea"
+version = "0.0.0"
+edition.workspace = true
+repository.workspace = true
+license-file = "../../LICENSE.md"
+description = "The GitButler Gitea integration"
+authors.workspace = true
+readme = "../../README.md"
+publish = false
+rust-version.workspace = true
+
+[features]
+export-ts = ["dep:ts-rs"]
+export-schema = ["dep:schemars", "dep:but-schemars"]
+
+[lib]
+doctest = false
+
+[dependencies]
+but-secret.workspace = true
+but-forge-storage.workspace = true
+but-error.workspace = true
+serde.workspace = true
+anyhow.workspace = true
+reqwest = { workspace = true, features = ["json"] }
+ts-rs = { workspace = true, optional = true }
+schemars = { workspace = true, optional = true }
+but-schemars = { workspace = true, optional = true }
+
+[lints]
+workspace = true
diff --git a/crates/but-gitea/src/client.rs b/crates/but-gitea/src/client.rs
new file mode 100644
index 00000000000..ce7bfc47415
--- /dev/null
+++ b/crates/but-gitea/src/client.rs
@@ -0,0 +1,105 @@
+use anyhow::{Context, Result, bail};
+use but_secret::Sensitive;
+use reqwest::header::{ACCEPT, AUTHORIZATION, HeaderMap, HeaderValue, USER_AGENT};
+use serde::Deserialize;
+
+const GITEA_API_SUFFIX: &str = "/api/v1";
+
+pub struct GiteaClient {
+    client: reqwest::Client,
+    base_url: String,
+}
+
+impl GiteaClient {
+    pub fn new_with_host_override(access_token: &Sensitive<String>, host: &str) -> Result<Self> {
+        let mut headers = HeaderMap::new();
+        headers.insert(USER_AGENT, HeaderValue::from_static("gb-gitea-integration"));
+        headers.insert(ACCEPT, HeaderValue::from_static("application/json"));
+        headers.insert(
+            AUTHORIZATION,
+            HeaderValue::from_str(&format!("token {}", access_token.0))?,
+        );
+
+        let client = reqwest::Client::builder()
+            .default_headers(headers)
+            .build()?;
+
+        Ok(Self {
+            client,
+            base_url: normalize_api_base_url(host),
+        })
+    }
+
+    pub async fn get_authenticated(&self) -> Result<AuthenticatedUser> {
+        #[derive(Deserialize)]
+        struct User {
+            login: String,
+            full_name: String,
+            email: String,
+            avatar_url: Option<String>,
+        }
+
+        let url = format!("{}/user", self.base_url);
+        let response = self.client.get(&url).send().await?;
+
+        if !response.status().is_success() {
+            bail!("Failed to get authenticated user: {}", response.status());
+        }
+
+        let user: User = response.json().await?;
+
+        Ok(AuthenticatedUser {
+            username: user.login,
+            avatar_url: user.avatar_url,
+            name: option_if_non_empty(user.full_name),
+            email: option_if_non_empty(user.email),
+        })
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct AuthenticatedUser {
+    pub username: String,
+    pub avatar_url: Option<String>,
+    pub name: Option<String>,
+    pub email: Option<String>,
+}
+
+fn option_if_non_empty(value: String) -> Option<String> {
+    (!value.trim().is_empty()).then_some(value)
+}
+
+fn normalize_api_base_url(host: &str) -> String {
+    let trimmed = host.trim_end_matches('/');
+    if trimmed.ends_with(GITEA_API_SUFFIX) {
+        trimmed.to_string()
+    } else {
+        format!("{trimmed}{GITEA_API_SUFFIX}")
+    }
+}
+
+pub fn client_for(account: &crate::GiteaAccountIdentifier, access_token: &Sensitive<String>) -> Result<GiteaClient> {
+    GiteaClient::new_with_host_override(access_token, &account.host)
+        .with_context(|| format!("Failed to create Gitea client for {}", account.host))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::normalize_api_base_url;
+
+    #[test]
+    fn appends_api_suffix_once() {
+        assert_eq!(
+            normalize_api_base_url("https://codeberg.org"),
+            "https://codeberg.org/api/v1"
+        );
+        assert_eq!(
+            normalize_api_base_url("https://codeberg.org/"),
+            "https://codeberg.org/api/v1"
+        );
+        assert_eq!(
+            normalize_api_base_url("https://codeberg.org/api/v1"),
+            "https://codeberg.org/api/v1"
+        );
+    }
+}
diff --git a/crates/but-gitea/src/lib.rs b/crates/but-gitea/src/lib.rs
new file mode 100644
index 00000000000..63b5cea7bbf
--- /dev/null
+++ b/crates/but-gitea/src/lib.rs
@@ -0,0 +1,191 @@
+use anyhow::{Context as _, Result};
+use but_secret::Sensitive;
+
+mod client;
+mod token;
+
+pub use client::AuthenticatedUser as ClientAuthenticatedUser;
+pub use token::GiteaAccountIdentifier;
+
+#[derive(Debug, Clone)]
+pub struct AuthStatusResponse {
+    pub access_token: Sensitive<String>,
+    pub username: String,
+    pub name: Option<String>,
+    pub email: Option<String>,
+    pub host: String,
+}
+
+pub async fn store_account(
+    host: &str,
+    access_token: &Sensitive<String>,
+    storage: &but_forge_storage::Controller,
+) -> Result<AuthStatusResponse> {
+    let user = fetch_and_persist_user_data(host, access_token, storage).await?;
+    Ok(AuthStatusResponse {
+        access_token: access_token.clone(),
+        username: user.username,
+        name: user.name,
+        email: user.email,
+        host: host.to_owned(),
+    })
+}
+
+async fn fetch_and_persist_user_data(
+    host: &str,
+    access_token: &Sensitive<String>,
+    storage: &but_forge_storage::Controller,
+) -> Result<client::AuthenticatedUser> {
+    let client = client::GiteaClient::new_with_host_override(access_token, host)
+        .context("Failed to create Gitea client")?;
+    let user = client
+        .get_authenticated()
+        .await
+        .context("Failed to get authenticated user")?;
+    token::persist_gitea_access_token(
+        &token::GiteaAccountIdentifier::new(&user.username, host),
+        access_token,
+        storage,
+    )
+    .context("Failed to persist access token")?;
+    Ok(user)
+}
+
+pub fn forget_gitea_access_token(
+    account: &GiteaAccountIdentifier,
+    storage: &but_forge_storage::Controller,
+) -> Result<()> {
+    token::delete_gitea_access_token(account, storage).context("Failed to delete access token")
+}
+
+pub async fn get_gitea_user(
+    account: &GiteaAccountIdentifier,
+    storage: &but_forge_storage::Controller,
+) -> Result<Option<AuthenticatedUser>> {
+    if let Some(access_token) = token::get_gitea_access_token(account, storage)? {
+        let client = account
+            .client(&access_token)
+            .context("Failed to create Gitea client")?;
+        let user = match client.get_authenticated().await {
+            Ok(user) => user,
+            Err(client_err) => {
+                if let Some(reqwest_err) = client_err.downcast_ref::<reqwest::Error>()
+                    && is_network_error(reqwest_err)
+                {
+                    return Err(client_err.context(but_error::Context::new_static(
+                        but_error::Code::NetworkError,
+                        "Unable to connect to Gitea.",
+                    )));
+                }
+                return Err(client_err.context("Failed to get authenticated user"));
+            }
+        };
+        Ok(Some(AuthenticatedUser {
+            access_token,
+            username: user.username,
+            avatar_url: user.avatar_url,
+            name: user.name,
+            email: user.email,
+            host: account.host.clone(),
+        }))
+    } else {
+        Ok(None)
+    }
+}
+
+fn is_network_error(err: &reqwest::Error) -> bool {
+    err.is_timeout() || err.is_connect() || err.is_request()
+}
+
+pub fn list_known_gitea_accounts(
+    storage: &but_forge_storage::Controller,
+) -> Result<Vec<GiteaAccountIdentifier>> {
+    token::list_known_gitea_accounts(storage).context("Failed to list known Gitea accounts")
+}
+
+pub fn clear_all_gitea_tokens(storage: &but_forge_storage::Controller) -> Result<()> {
+    token::clear_all_gitea_accounts(storage).context("Failed to clear all Gitea tokens")
+}
+
+#[derive(Debug, Clone)]
+pub struct AuthenticatedUser {
+    pub access_token: Sensitive<String>,
+    pub username: String,
+    pub avatar_url: Option<String>,
+    pub name: Option<String>,
+    pub email: Option<String>,
+    pub host: String,
+}
+
+pub mod json {
+    use serde::Serialize;
+
+    use crate::{AuthStatusResponse, AuthenticatedUser};
+
+    #[derive(Debug, Serialize)]
+    #[cfg_attr(feature = "export-ts", derive(ts_rs::TS))]
+    #[serde(rename_all = "camelCase")]
+    #[cfg_attr(feature = "export-ts", ts(export, export_to = "./gitea/index.ts"))]
+    pub struct AuthStatusResponseSensitive {
+        pub access_token: String,
+        pub username: String,
+        pub name: Option<String>,
+        pub email: Option<String>,
+        pub host: String,
+    }
+
+    impl From<AuthStatusResponse> for AuthStatusResponseSensitive {
+        fn from(
+            AuthStatusResponse {
+                access_token,
+                username,
+                name,
+                email,
+                host,
+            }: AuthStatusResponse,
+        ) -> Self {
+            Self {
+                access_token: access_token.0,
+                username,
+                name,
+                email,
+                host,
+            }
+        }
+    }
+
+    #[derive(Debug, Serialize)]
+    #[cfg_attr(feature = "export-ts", derive(ts_rs::TS))]
+    #[serde(rename_all = "camelCase")]
+    #[cfg_attr(feature = "export-ts", ts(export, export_to = "./gitea/index.ts"))]
+    pub struct AuthenticatedUserSensitive {
+        pub access_token: String,
+        pub username: String,
+        pub avatar_url: Option<String>,
+        pub name: Option<String>,
+        pub email: Option<String>,
+        pub host: String,
+    }
+
+    impl From<AuthenticatedUser> for AuthenticatedUserSensitive {
+        fn from(
+            AuthenticatedUser {
+                access_token,
+                username,
+                avatar_url,
+                name,
+                email,
+                host,
+            }: AuthenticatedUser,
+        ) -> Self {
+            Self {
+                access_token: access_token.0,
+                username,
+                avatar_url,
+                name,
+                email,
+                host,
+            }
+        }
+    }
+}
diff --git a/crates/but-gitea/src/token.rs b/crates/but-gitea/src/token.rs
new file mode 100644
index 00000000000..1fb2cb6b563
--- /dev/null
+++ b/crates/but-gitea/src/token.rs
@@ -0,0 +1,193 @@
+use std::sync::Mutex;
+
+use anyhow::Result;
+use but_secret::{Sensitive, secret};
+use serde::{Deserialize, Serialize};
+
+use crate::client::GiteaClient;
+
+pub fn persist_gitea_access_token(
+    account_id: &GiteaAccountIdentifier,
+    access_token: &Sensitive<String>,
+    storage: &but_forge_storage::Controller,
+) -> Result<()> {
+    let account = GiteaAccount::new(account_id, access_token.clone());
+    persist_gitea_account(&account, storage)
+}
+
+pub fn delete_gitea_access_token(
+    account_id: &GiteaAccountIdentifier,
+    storage: &but_forge_storage::Controller,
+) -> Result<()> {
+    let account = find_gitea_account(account_id, storage)?;
+    if let Some(account) = account {
+        delete_gitea_account(&account, storage)
+    } else {
+        Ok(())
+    }
+}
+
+pub fn get_gitea_access_token(
+    account_id: &GiteaAccountIdentifier,
+    storage: &but_forge_storage::Controller,
+) -> Result<Option<Sensitive<String>>> {
+    let account = find_gitea_account(account_id, storage)?;
+    Ok(account.map(|account| account.access_token()))
+}
+
+pub fn list_known_gitea_accounts(
+    storage: &but_forge_storage::Controller,
+) -> Result<Vec<GiteaAccountIdentifier>> {
+    Ok(storage
+        .gitea_accounts()?
+        .iter()
+        .map(Into::into)
+        .collect::<Vec<_>>())
+}
+
+pub fn clear_all_gitea_accounts(storage: &but_forge_storage::Controller) -> Result<()> {
+    delete_all_gitea_accounts(storage)?;
+    Ok(())
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "export-ts", derive(ts_rs::TS))]
+#[cfg_attr(feature = "export-schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "export-ts", ts(export, export_to = "./gitea/token.ts"))]
+pub struct GiteaAccountIdentifier {
+    pub username: String,
+    pub host: String,
+}
+#[cfg(feature = "export-schema")]
+but_schemars::register_sdk_type!(GiteaAccountIdentifier);
+
+impl GiteaAccountIdentifier {
+    pub fn new(username: &str, host: &str) -> Self {
+        Self {
+            username: username.to_string(),
+            host: host.to_string(),
+        }
+    }
+
+    pub fn client(&self, access_token: &Sensitive<String>) -> Result<GiteaClient> {
+        crate::client::client_for(self, access_token)
+    }
+}
+
+impl std::fmt::Display for GiteaAccountIdentifier {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}@{}", self.username, self.host)
+    }
+}
+
+pub struct GiteaAccount {
+    username: String,
+    host: String,
+    access_token: Sensitive<String>,
+}
+
+impl From<&GiteaAccount> for but_forge_storage::settings::GiteaAccount {
+    fn from(account: &GiteaAccount) -> Self {
+        but_forge_storage::settings::GiteaAccount {
+            username: account.username.clone(),
+            host: account.host.clone(),
+            access_token_key: account.secret_key(),
+        }
+    }
+}
+
+impl From<&but_forge_storage::settings::GiteaAccount> for GiteaAccountIdentifier {
+    fn from(account: &but_forge_storage::settings::GiteaAccount) -> Self {
+        Self {
+            username: account.username.clone(),
+            host: account.host.clone(),
+        }
+    }
+}
+
+impl GiteaAccount {
+    pub fn new(account_id: &GiteaAccountIdentifier, access_token: Sensitive<String>) -> Self {
+        Self {
+            username: account_id.username.clone(),
+            host: account_id.host.clone(),
+            access_token,
+        }
+    }
+
+    fn secret_key(&self) -> String {
+        format!("gitea_{}_{}", self.host, self.username)
+    }
+
+    fn access_token(&self) -> Sensitive<String> {
+        self.access_token.clone()
+    }
+}
+
+fn retrieve_gitea_secret(secret_key: &str) -> Result<Option<Sensitive<String>>> {
+    static FAIR_QUEUE: Mutex<()> = Mutex::new(());
+    let _one_at_a_time_to_prevent_races = FAIR_QUEUE.lock().unwrap();
+    secret::retrieve(secret_key, secret::Namespace::BuildKind)
+}
+
+fn persist_gitea_account(
+    account: &GiteaAccount,
+    storage: &but_forge_storage::Controller,
+) -> Result<()> {
+    let secret_key = account.secret_key();
+    storage.add_gitea_account(&account.into())?;
+
+    static FAIR_QUEUE: Mutex<()> = Mutex::new(());
+    let _one_at_a_time_to_prevent_races = FAIR_QUEUE.lock().unwrap();
+    secret::persist(
+        &secret_key,
+        &account.access_token(),
+        secret::Namespace::BuildKind,
+    )
+}
+
+fn delete_gitea_account(
+    account: &GiteaAccount,
+    storage: &but_forge_storage::Controller,
+) -> Result<()> {
+    let secret_key = account.secret_key();
+    storage.remove_gitea_account(&account.into())?;
+
+    static FAIR_QUEUE: Mutex<()> = Mutex::new(());
+    let _one_at_a_time_to_prevent_races = FAIR_QUEUE.lock().unwrap();
+    secret::delete(&secret_key, secret::Namespace::BuildKind)
+}
+
+fn delete_all_gitea_accounts(storage: &but_forge_storage::Controller) -> Result<()> {
+    let keys_to_delete = storage.clear_all_gitea_accounts()?;
+    static FAIR_QUEUE: Mutex<()> = Mutex::new(());
+    let _one_at_a_time_to_prevent_races = FAIR_QUEUE.lock().unwrap();
+    for key in keys_to_delete {
+        secret::delete(&key, secret::Namespace::BuildKind)?;
+    }
+    Ok(())
+}
+
+fn find_gitea_account(
+    account_id: &GiteaAccountIdentifier,
+    storage: &but_forge_storage::Controller,
+) -> Result<Option<GiteaAccount>> {
+    let accounts = storage.gitea_accounts()?;
+    let result = accounts.iter().find_map(|account| {
+        if account.username == account_id.username
+            && account.host == account_id.host
+            && let Some(access_token) = retrieve_gitea_secret(&account.access_token_key)
+                .ok()
+                .flatten()
+        {
+            return Some(GiteaAccount {
+                username: account.username.clone(),
+                host: account.host.clone(),
+                access_token,
+            });
+        }
+        None
+    });
+
+    Ok(result)
+}
diff --git a/crates/but-server/src/lib.rs b/crates/but-server/src/lib.rs
index 10fb7f7ee4a..91c7a8c73af 100644
--- a/crates/but-server/src/lib.rs
+++ b/crates/but-server/src/lib.rs
@@ -12,7 +12,7 @@ use axum::{
     response::IntoResponse,
     routing::{MethodRouter, any, post},
 };
-use but_api::{commit, diff, github, gitlab, json, legacy, platform};
+use but_api::{commit, diff, gitea, github, gitlab, json, legacy, platform};
 use but_claude::{Broadcaster, Claude};
 use but_ctx::{Context, ProjectHandleOrLegacyProjectId};
 #[cfg(feature = "irc")]
@@ -606,6 +606,18 @@ pub async fn run() {
             "/clear_all_gitlab_tokens",
             but_post(gitlab::clear_all_gitlab_tokens_cmd),
         )
+        .route(
+            "/forget_gitea_account",
+            but_post(gitea::forget_gitea_account_cmd),
+        )
+        .route(
+            "/list_known_gitea_accounts",
+            but_post(gitea::list_known_gitea_accounts_cmd),
+        )
+        .route(
+            "/clear_all_gitea_tokens",
+            but_post(gitea::clear_all_gitea_tokens_cmd),
+        )
         // Forge commands
         .route("/pr_templates", but_post(legacy::forge::pr_templates_cmd))
         .route("/pr_template", but_post(legacy::forge::pr_template_cmd))
diff --git a/crates/gitbutler-tauri/src/main.rs b/crates/gitbutler-tauri/src/main.rs
index 76306543055..9eb59428c0d 100644
--- a/crates/gitbutler-tauri/src/main.rs
+++ b/crates/gitbutler-tauri/src/main.rs
@@ -14,7 +14,7 @@
 use std::sync::Arc;
 
 use anyhow::{Context, bail};
-use but_api::{commit, diff, github, gitlab, legacy, platform};
+use but_api::{commit, diff, gitea, github, gitlab, legacy, platform};
 use but_claude::{Broadcaster, Claude};
 #[cfg(feature = "irc")]
 use but_irc::IrcManager;
@@ -310,6 +310,11 @@ fn main() -> anyhow::Result<()> {
                 gitlab::tauri_forget_gitlab_account::forget_gitlab_account,
                 gitlab::tauri_list_known_gitlab_accounts::list_known_gitlab_accounts,
                 gitlab::tauri_clear_all_gitlab_tokens::clear_all_gitlab_tokens,
+                gitea::tauri_store_gitea_account::store_gitea_account,
+                gitea::tauri_get_gitea_user::get_gitea_user,
+                gitea::tauri_forget_gitea_account::forget_gitea_account,
+                gitea::tauri_list_known_gitea_accounts::list_known_gitea_accounts,
+                gitea::tauri_clear_all_gitea_tokens::clear_all_gitea_tokens,
                 diff::tauri_commit_details::commit_details,
                 diff::tauri_commit_details_with_line_stats::commit_details_with_line_stats,
                 but_api::branch::tauri_branch_diff::branch_diff,
diff --git a/packages/core/src/generated/gitea/index.ts b/packages/core/src/generated/gitea/index.ts
new file mode 100644
index 00000000000..e3b6c0fb5b5
--- /dev/null
+++ b/packages/core/src/generated/gitea/index.ts
@@ -0,0 +1,5 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type AuthStatusResponseSensitive = { accessToken: string, username: string, name: string | null, email: string | null, host: string, };
+
+export type AuthenticatedUserSensitive = { accessToken: string, username: string, avatarUrl: string | null, name: string | null, email: string | null, host: string, };
diff --git a/packages/core/src/generated/gitea/token.ts b/packages/core/src/generated/gitea/token.ts
new file mode 100644
index 00000000000..d48c9ee6d3a
--- /dev/null
+++ b/packages/core/src/generated/gitea/token.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type GiteaAccountIdentifier = { username: string, host: string, };
diff --git a/packages/core/src/generated/index.ts b/packages/core/src/generated/index.ts
index fb08d18eb95..75bceff8e10 100644
--- a/packages/core/src/generated/index.ts
+++ b/packages/core/src/generated/index.ts
@@ -9,6 +9,8 @@ export * as Action from "./action/autoCommit";
 export type { ForgeUser } from "./forge/user";
 export * as ButGitHub from "./github/index";
 export * as ButGitHubToken from "./github/token";
+export * as ButGitea from "./gitea/index";
+export * as ButGiteaToken from "./gitea/token";
 export * as ButGitLab from "./gitlab/index";
 export * as ButGitLabToken from "./gitlab/token";
 export type { GitConfigSettings } from "./settings/gitConfigSettings";

From 53e774babffef0c05f9a8708ccfa93743e82f631 Mon Sep 17 00:00:00 2001
From: javery556 <128285906+javery556@users.noreply.github.com>
Date: Thu, 19 Mar 2026 10:52:35 +1100
Subject: [PATCH 2/3] fix: document and wire gitea auth flow

---
 .../src/components/GiteaAccountBadge.svelte   |  5 ++-
 .../src/components/GiteaIntegration.svelte    |  6 ++--
 .../forge/gitea/giteaUserService.svelte.ts    |  5 +--
 crates/but-forge-storage/src/controller.rs    |  5 +--
 crates/but-gitea/Cargo.toml                   |  2 +-
 crates/but-gitea/README.md                    | 34 +++++++++++++++++++
 crates/but-gitea/src/client.rs                | 11 +++++-
 crates/but-gitea/src/lib.rs                   | 20 +++++++++++
 crates/but-gitea/src/token.rs                 | 11 ++++++
 crates/but-server/src/lib.rs                  |  5 +++
 packages/core/src/generated/gitea/index.ts    | 23 +++++++++++--
 packages/core/src/generated/gitea/token.ts    |  5 ++-
 12 files changed, 115 insertions(+), 17 deletions(-)
 create mode 100644 crates/but-gitea/README.md

diff --git a/apps/desktop/src/components/GiteaAccountBadge.svelte b/apps/desktop/src/components/GiteaAccountBadge.svelte
index 49bce4a609b..0585dce477c 100644
--- a/apps/desktop/src/components/GiteaAccountBadge.svelte
+++ b/apps/desktop/src/components/GiteaAccountBadge.svelte
@@ -10,7 +10,10 @@
 	const { account, class: className }: Props = $props();
 
 	function normalizedHost(host: string): string {
-		return host.replace(/^https?:\/\//, "").replace(/\/api\/v1\/?$/, "").replace(/\/$/, "");
+		return host
+			.replace(/^https?:\/\//, "")
+			.replace(/\/api\/v1\/?$/, "")
+			.replace(/\/$/, "");
 	}
 
 	export function badgeText(account: ButGiteaToken.GiteaAccountIdentifier): string {
diff --git a/apps/desktop/src/components/GiteaIntegration.svelte b/apps/desktop/src/components/GiteaIntegration.svelte
index 62a567cdbc8..7314092a96c 100644
--- a/apps/desktop/src/components/GiteaIntegration.svelte
+++ b/apps/desktop/src/components/GiteaIntegration.svelte
@@ -155,15 +155,15 @@
 <style lang="postcss">
 	.icon-wrapper__logo {
 		display: flex;
-		width: 28px;
-		height: 28px;
 		align-items: center;
 		justify-content: center;
+		width: 28px;
+		height: 28px;
 		border-radius: 999px;
 		background: var(--clr-bg-3);
 		color: var(--clr-text-1);
-		font-size: 11px;
 		font-weight: 700;
+		font-size: 11px;
 		letter-spacing: 0.08em;
 	}
 
diff --git a/apps/desktop/src/lib/forge/gitea/giteaUserService.svelte.ts b/apps/desktop/src/lib/forge/gitea/giteaUserService.svelte.ts
index 40dbf340419..8829db06be7 100644
--- a/apps/desktop/src/lib/forge/gitea/giteaUserService.svelte.ts
+++ b/apps/desktop/src/lib/forge/gitea/giteaUserService.svelte.ts
@@ -84,10 +84,7 @@ function injectBackendEndpoints(api: BackendApi) {
 				},
 				query: (args) => args,
 				providesTags: (_result, _error, { account }) => [
-					...providesItem(
-						ReduxTag.ForgeUser,
-						`gitea:${account.host}:${account.username}`,
-					),
+					...providesItem(ReduxTag.ForgeUser, `gitea:${account.host}:${account.username}`),
 				],
 			}),
 			listKnownGiteaAccounts: build.query<ButGiteaToken.GiteaAccountIdentifier[], void>({
diff --git a/crates/but-forge-storage/src/controller.rs b/crates/but-forge-storage/src/controller.rs
index 45e84d73671..d5a1fb32980 100644
--- a/crates/but-forge-storage/src/controller.rs
+++ b/crates/but-forge-storage/src/controller.rs
@@ -120,10 +120,7 @@ impl Controller {
     }
 
     /// Add a Gitea account if it does not already exist.
-    pub fn add_gitea_account(
-        &self,
-        account: &crate::settings::GiteaAccount,
-    ) -> anyhow::Result<()> {
+    pub fn add_gitea_account(&self, account: &crate::settings::GiteaAccount) -> anyhow::Result<()> {
         let mut settings = self.read_settings()?;
 
         if settings.gitea.known_accounts.iter().any(|a| a == account) {
diff --git a/crates/but-gitea/Cargo.toml b/crates/but-gitea/Cargo.toml
index 7194787baf0..dee841a1010 100644
--- a/crates/but-gitea/Cargo.toml
+++ b/crates/but-gitea/Cargo.toml
@@ -6,7 +6,7 @@ repository.workspace = true
 license-file = "../../LICENSE.md"
 description = "The GitButler Gitea integration"
 authors.workspace = true
-readme = "../../README.md"
+readme = "README.md"
 publish = false
 rust-version.workspace = true
 
diff --git a/crates/but-gitea/README.md b/crates/but-gitea/README.md
new file mode 100644
index 00000000000..24a63f116c8
--- /dev/null
+++ b/crates/but-gitea/README.md
@@ -0,0 +1,34 @@
+# but-gitea
+
+Minimal Gitea authentication support for GitButler.
+
+This crate intentionally covers a narrow, reviewable slice of the eventual Gitea
+integration work:
+
+- validate a personal access token against a Gitea-compatible host
+- fetch the authenticated user from `/api/v1/user`
+- persist per-host account metadata in `but-forge-storage`
+- persist the token itself in OS-backed secure storage via `but-secret`
+- export the account and auth response types to TypeScript for the desktop UI
+
+It does not currently implement repository discovery, remote detection, pull
+request flows, or OAuth.
+
+## Module layout
+
+- `client.rs`: thin authenticated client for the small auth surface we need now
+- `token.rs`: account identifiers plus secure token persistence helpers
+- `lib.rs`: high-level account management API used by `but-api`
+
+## Manual verification
+
+The auth flow was designed to be easy to smoke-test against a real local Gitea
+instance.
+
+1. Start a local Gitea 1.25.x server.
+2. Create a user and personal access token with `all` scope.
+3. Call `store_account()` with the instance URL and PAT.
+4. Confirm `list_known_gitea_accounts()` returns `username@host`.
+5. Confirm `get_gitea_user()` reloads the stored account and fetches the live
+   user profile.
+6. Confirm `forget_gitea_access_token()` removes the account and token.
diff --git a/crates/but-gitea/src/client.rs b/crates/but-gitea/src/client.rs
index ce7bfc47415..433200585bf 100644
--- a/crates/but-gitea/src/client.rs
+++ b/crates/but-gitea/src/client.rs
@@ -1,3 +1,5 @@
+//! Thin Gitea API client used by the authentication slice.
+
 use anyhow::{Context, Result, bail};
 use but_secret::Sensitive;
 use reqwest::header::{ACCEPT, AUTHORIZATION, HeaderMap, HeaderValue, USER_AGENT};
@@ -11,6 +13,7 @@ pub struct GiteaClient {
 }
 
 impl GiteaClient {
+    /// Create an authenticated client for an arbitrary Gitea-compatible host.
     pub fn new_with_host_override(access_token: &Sensitive<String>, host: &str) -> Result<Self> {
         let mut headers = HeaderMap::new();
         headers.insert(USER_AGENT, HeaderValue::from_static("gb-gitea-integration"));
@@ -30,6 +33,7 @@ impl GiteaClient {
         })
     }
 
+    /// Resolve the currently authenticated user from `/api/v1/user`.
     pub async fn get_authenticated(&self) -> Result<AuthenticatedUser> {
         #[derive(Deserialize)]
         struct User {
@@ -69,6 +73,7 @@ fn option_if_non_empty(value: String) -> Option<String> {
     (!value.trim().is_empty()).then_some(value)
 }
 
+/// Normalize either an instance root URL or API root to the `/api/v1` base path.
 fn normalize_api_base_url(host: &str) -> String {
     let trimmed = host.trim_end_matches('/');
     if trimmed.ends_with(GITEA_API_SUFFIX) {
@@ -78,7 +83,11 @@ fn normalize_api_base_url(host: &str) -> String {
     }
 }
 
-pub fn client_for(account: &crate::GiteaAccountIdentifier, access_token: &Sensitive<String>) -> Result<GiteaClient> {
+/// Recreate a client for a previously persisted account identifier.
+pub fn client_for(
+    account: &crate::GiteaAccountIdentifier,
+    access_token: &Sensitive<String>,
+) -> Result<GiteaClient> {
     GiteaClient::new_with_host_override(access_token, &account.host)
         .with_context(|| format!("Failed to create Gitea client for {}", account.host))
 }
diff --git a/crates/but-gitea/src/lib.rs b/crates/but-gitea/src/lib.rs
index 63b5cea7bbf..9f07eb9328a 100644
--- a/crates/but-gitea/src/lib.rs
+++ b/crates/but-gitea/src/lib.rs
@@ -1,3 +1,10 @@
+//! Minimal Gitea account authentication and token-management support for GitButler.
+//!
+//! The crate is intentionally narrow: it validates a PAT against a Gitea-compatible
+//! host, stores the authenticated account metadata, and lets callers rehydrate or
+//! forget stored accounts later. Higher-level forge features are deliberately left
+//! to follow-up work so this slice stays reviewable.
+
 use anyhow::{Context as _, Result};
 use but_secret::Sensitive;
 
@@ -9,6 +16,10 @@ pub use token::GiteaAccountIdentifier;
 
 #[derive(Debug, Clone)]
 pub struct AuthStatusResponse {
+    /// The access token.
+    ///
+    /// This is returned only so the current desktop integration can continue to
+    /// use the token immediately after storing it.
     pub access_token: Sensitive<String>,
     pub username: String,
     pub name: Option<String>,
@@ -16,6 +27,7 @@ pub struct AuthStatusResponse {
     pub host: String,
 }
 
+/// Validate a Gitea PAT for `host`, persist it securely, and return the resolved account.
 pub async fn store_account(
     host: &str,
     access_token: &Sensitive<String>,
@@ -31,6 +43,7 @@ pub async fn store_account(
     })
 }
 
+/// Fetch the authenticated user from Gitea and persist the token under that account id.
 async fn fetch_and_persist_user_data(
     host: &str,
     access_token: &Sensitive<String>,
@@ -51,6 +64,7 @@ async fn fetch_and_persist_user_data(
     Ok(user)
 }
 
+/// Delete the stored token and metadata for a single Gitea account.
 pub fn forget_gitea_access_token(
     account: &GiteaAccountIdentifier,
     storage: &but_forge_storage::Controller,
@@ -58,6 +72,7 @@ pub fn forget_gitea_access_token(
     token::delete_gitea_access_token(account, storage).context("Failed to delete access token")
 }
 
+/// Resolve a stored Gitea account and return the current authenticated user profile, if any.
 pub async fn get_gitea_user(
     account: &GiteaAccountIdentifier,
     storage: &but_forge_storage::Controller,
@@ -97,18 +112,21 @@ fn is_network_error(err: &reqwest::Error) -> bool {
     err.is_timeout() || err.is_connect() || err.is_request()
 }
 
+/// List all Gitea accounts whose metadata is currently persisted locally.
 pub fn list_known_gitea_accounts(
     storage: &but_forge_storage::Controller,
 ) -> Result<Vec<GiteaAccountIdentifier>> {
     token::list_known_gitea_accounts(storage).context("Failed to list known Gitea accounts")
 }
 
+/// Delete all stored Gitea accounts and their associated tokens.
 pub fn clear_all_gitea_tokens(storage: &but_forge_storage::Controller) -> Result<()> {
     token::clear_all_gitea_accounts(storage).context("Failed to clear all Gitea tokens")
 }
 
 #[derive(Debug, Clone)]
 pub struct AuthenticatedUser {
+    /// The access token used to authenticate the live request.
     pub access_token: Sensitive<String>,
     pub username: String,
     pub avatar_url: Option<String>,
@@ -122,6 +140,7 @@ pub mod json {
 
     use crate::{AuthStatusResponse, AuthenticatedUser};
 
+    /// Serializable version of [`AuthStatusResponse`] with the token exposed as a string.
     #[derive(Debug, Serialize)]
     #[cfg_attr(feature = "export-ts", derive(ts_rs::TS))]
     #[serde(rename_all = "camelCase")]
@@ -154,6 +173,7 @@ pub mod json {
         }
     }
 
+    /// Serializable version of [`AuthenticatedUser`] with the token exposed as a string.
     #[derive(Debug, Serialize)]
     #[cfg_attr(feature = "export-ts", derive(ts_rs::TS))]
     #[serde(rename_all = "camelCase")]
diff --git a/crates/but-gitea/src/token.rs b/crates/but-gitea/src/token.rs
index 1fb2cb6b563..917499796e6 100644
--- a/crates/but-gitea/src/token.rs
+++ b/crates/but-gitea/src/token.rs
@@ -1,3 +1,5 @@
+//! Account identifiers and secure token persistence for Gitea integrations.
+
 use std::sync::Mutex;
 
 use anyhow::Result;
@@ -6,6 +8,7 @@ use serde::{Deserialize, Serialize};
 
 use crate::client::GiteaClient;
 
+/// Persist a Gitea access token and its corresponding account metadata.
 pub fn persist_gitea_access_token(
     account_id: &GiteaAccountIdentifier,
     access_token: &Sensitive<String>,
@@ -15,6 +18,7 @@ pub fn persist_gitea_access_token(
     persist_gitea_account(&account, storage)
 }
 
+/// Delete a stored Gitea access token for the given account.
 pub fn delete_gitea_access_token(
     account_id: &GiteaAccountIdentifier,
     storage: &but_forge_storage::Controller,
@@ -27,6 +31,7 @@ pub fn delete_gitea_access_token(
     }
 }
 
+/// Retrieve a stored Gitea access token for the given account.
 pub fn get_gitea_access_token(
     account_id: &GiteaAccountIdentifier,
     storage: &but_forge_storage::Controller,
@@ -35,6 +40,7 @@ pub fn get_gitea_access_token(
     Ok(account.map(|account| account.access_token()))
 }
 
+/// List all Gitea accounts currently known to local forge storage.
 pub fn list_known_gitea_accounts(
     storage: &but_forge_storage::Controller,
 ) -> Result<Vec<GiteaAccountIdentifier>> {
@@ -45,11 +51,13 @@ pub fn list_known_gitea_accounts(
         .collect::<Vec<_>>())
 }
 
+/// Delete all stored Gitea accounts.
 pub fn clear_all_gitea_accounts(storage: &but_forge_storage::Controller) -> Result<()> {
     delete_all_gitea_accounts(storage)?;
     Ok(())
 }
 
+/// Stable identifier for a persisted Gitea account.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[cfg_attr(feature = "export-ts", derive(ts_rs::TS))]
 #[cfg_attr(feature = "export-schema", derive(schemars::JsonSchema))]
@@ -63,6 +71,7 @@ pub struct GiteaAccountIdentifier {
 but_schemars::register_sdk_type!(GiteaAccountIdentifier);
 
 impl GiteaAccountIdentifier {
+    /// Build an identifier from the authenticated username and host.
     pub fn new(username: &str, host: &str) -> Self {
         Self {
             username: username.to_string(),
@@ -70,6 +79,7 @@ impl GiteaAccountIdentifier {
         }
     }
 
+    /// Recreate a client for this stored account.
     pub fn client(&self, access_token: &Sensitive<String>) -> Result<GiteaClient> {
         crate::client::client_for(self, access_token)
     }
@@ -81,6 +91,7 @@ impl std::fmt::Display for GiteaAccountIdentifier {
     }
 }
 
+/// Persisted Gitea account with its associated secret token.
 pub struct GiteaAccount {
     username: String,
     host: String,
diff --git a/crates/but-server/src/lib.rs b/crates/but-server/src/lib.rs
index 91c7a8c73af..1c0315169a1 100644
--- a/crates/but-server/src/lib.rs
+++ b/crates/but-server/src/lib.rs
@@ -606,6 +606,11 @@ pub async fn run() {
             "/clear_all_gitlab_tokens",
             but_post(gitlab::clear_all_gitlab_tokens_cmd),
         )
+        .route(
+            "/store_gitea_account",
+            but_post_async(gitea::store_gitea_account_cmd),
+        )
+        .route("/get_gitea_user", but_post_async(gitea::get_gitea_user_cmd))
         .route(
             "/forget_gitea_account",
             but_post(gitea::forget_gitea_account_cmd),
diff --git a/packages/core/src/generated/gitea/index.ts b/packages/core/src/generated/gitea/index.ts
index e3b6c0fb5b5..64f77e01be2 100644
--- a/packages/core/src/generated/gitea/index.ts
+++ b/packages/core/src/generated/gitea/index.ts
@@ -1,5 +1,24 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type AuthStatusResponseSensitive = { accessToken: string, username: string, name: string | null, email: string | null, host: string, };
+/**
+ * Serializable version of [`AuthStatusResponse`] with the token exposed as a string.
+ */
+export type AuthStatusResponseSensitive = {
+	accessToken: string;
+	username: string;
+	name: string | null;
+	email: string | null;
+	host: string;
+};
 
-export type AuthenticatedUserSensitive = { accessToken: string, username: string, avatarUrl: string | null, name: string | null, email: string | null, host: string, };
+/**
+ * Serializable version of [`AuthenticatedUser`] with the token exposed as a string.
+ */
+export type AuthenticatedUserSensitive = {
+	accessToken: string;
+	username: string;
+	avatarUrl: string | null;
+	name: string | null;
+	email: string | null;
+	host: string;
+};
diff --git a/packages/core/src/generated/gitea/token.ts b/packages/core/src/generated/gitea/token.ts
index d48c9ee6d3a..b4c1b74ca6f 100644
--- a/packages/core/src/generated/gitea/token.ts
+++ b/packages/core/src/generated/gitea/token.ts
@@ -1,3 +1,6 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type GiteaAccountIdentifier = { username: string, host: string, };
+/**
+ * Stable identifier for a persisted Gitea account.
+ */
+export type GiteaAccountIdentifier = { username: string; host: string };

From a08386e2201c26738706346245b6557ad8e9e43c Mon Sep 17 00:00:00 2001
From: javery556 <128285906+javery556@users.noreply.github.com>
Date: Thu, 19 Mar 2026 14:12:42 +1100
Subject: [PATCH 3/3] fix: address gitea review feedback

---
 Cargo.lock                                    |  1 +
 Cargo.toml                                    |  2 +-
 .../src/components/GiteaIntegration.svelte    | 18 ++--
 crates/but-gitea/Cargo.toml                   |  3 +
 crates/but-gitea/src/token.rs                 | 86 +++++++++++++------
 5 files changed, 75 insertions(+), 35 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index f6670681541..251263a8b53 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1220,6 +1220,7 @@ dependencies = [
  "reqwest 0.12.28",
  "schemars 1.2.1",
  "serde",
+ "tempfile",
  "ts-rs",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 50f70af5250..9dfc185f795 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -66,7 +66,7 @@ members = [
     "crates/but-github", # 📄A thin wrapper of the GitHub API, for authentication and resource access.
     # 👉lacks top-level docs and docs.
     "crates/but-gitlab", # 📄A thin wrapper of the GitLab API, for authentication and resource access.
-    # 👉No tests, lacks top-level docs, purpose somewhat unclear.
+    # 👉Has basic tests and top-level docs; purpose is intentionally narrow.
     "crates/but-gitea", # 📄A thin wrapper of the Gitea API, for authentication and resource access.
     # 👉No tests, lacks top-level docs, purpose somewhat unclear.
     "crates/but-cursor", # 📄Integration with Cursor
diff --git a/apps/desktop/src/components/GiteaIntegration.svelte b/apps/desktop/src/components/GiteaIntegration.svelte
index 7314092a96c..9ae136fabee 100644
--- a/apps/desktop/src/components/GiteaIntegration.svelte
+++ b/apps/desktop/src/components/GiteaIntegration.svelte
@@ -8,7 +8,6 @@
 
 	const giteaUserService = inject(GITEA_USER_SERVICE);
 
-	const [clearAll, clearingAllResult] = giteaUserService.deleteAllGiteaAccounts();
 	const [storeAccount, storeAccountResult] = giteaUserService.storeGiteaAccount;
 	const accounts = giteaUserService.accounts();
 
@@ -17,6 +16,7 @@
 	let patInput = $state<string>();
 	let hostError = $state<string>();
 	let patError = $state<string>();
+	let retryingAccounts = $state(false);
 
 	function cleanupFlow() {
 		showingFlow = false;
@@ -30,9 +30,13 @@
 		showingFlow = true;
 	}
 
-	async function deleteAllGiteaAccounts() {
-		await clearAll();
-		startFlow();
+	async function retryLoadAccounts() {
+		retryingAccounts = true;
+		try {
+			await accounts.result.refetch();
+		} finally {
+			retryingAccounts = false;
+		}
 	}
 
 	async function storeToken() {
@@ -58,10 +62,8 @@
 					{#snippet title()}
 						Failed to load Gitea accounts
 					{/snippet}
-					<Button
-						style="pop"
-						onclick={deleteAllGiteaAccounts}
-						loading={clearingAllResult.current.isLoading}>Try again</Button
+					<Button style="pop" onclick={retryLoadAccounts} loading={retryingAccounts}
+						>Try again</Button
 					>
 				</CardGroup.Item>
 			{/snippet}
diff --git a/crates/but-gitea/Cargo.toml b/crates/but-gitea/Cargo.toml
index dee841a1010..98b1e1f9af9 100644
--- a/crates/but-gitea/Cargo.toml
+++ b/crates/but-gitea/Cargo.toml
@@ -28,5 +28,8 @@ ts-rs = { workspace = true, optional = true }
 schemars = { workspace = true, optional = true }
 but-schemars = { workspace = true, optional = true }
 
+[dev-dependencies]
+tempfile.workspace = true
+
 [lints]
 workspace = true
diff --git a/crates/but-gitea/src/token.rs b/crates/but-gitea/src/token.rs
index 917499796e6..df40e80f8b3 100644
--- a/crates/but-gitea/src/token.rs
+++ b/crates/but-gitea/src/token.rs
@@ -8,6 +8,8 @@ use serde::{Deserialize, Serialize};
 
 use crate::client::GiteaClient;
 
+static FAIR_QUEUE: Mutex<()> = Mutex::new(());
+
 /// Persist a Gitea access token and its corresponding account metadata.
 pub fn persist_gitea_access_token(
     account_id: &GiteaAccountIdentifier,
@@ -23,7 +25,7 @@ pub fn delete_gitea_access_token(
     account_id: &GiteaAccountIdentifier,
     storage: &but_forge_storage::Controller,
 ) -> Result<()> {
-    let account = find_gitea_account(account_id, storage)?;
+    let account = find_persisted_gitea_account(account_id, storage)?;
     if let Some(account) = account {
         delete_gitea_account(&account, storage)
     } else {
@@ -136,7 +138,6 @@ impl GiteaAccount {
 }
 
 fn retrieve_gitea_secret(secret_key: &str) -> Result<Option<Sensitive<String>>> {
-    static FAIR_QUEUE: Mutex<()> = Mutex::new(());
     let _one_at_a_time_to_prevent_races = FAIR_QUEUE.lock().unwrap();
     secret::retrieve(secret_key, secret::Namespace::BuildKind)
 }
@@ -146,32 +147,33 @@ fn persist_gitea_account(
     storage: &but_forge_storage::Controller,
 ) -> Result<()> {
     let secret_key = account.secret_key();
-    storage.add_gitea_account(&account.into())?;
-
-    static FAIR_QUEUE: Mutex<()> = Mutex::new(());
     let _one_at_a_time_to_prevent_races = FAIR_QUEUE.lock().unwrap();
     secret::persist(
         &secret_key,
         &account.access_token(),
         secret::Namespace::BuildKind,
-    )
+    )?;
+
+    if let Err(err) = storage.add_gitea_account(&account.into()) {
+        let _ = secret::delete(&secret_key, secret::Namespace::BuildKind);
+        return Err(err);
+    }
+
+    Ok(())
 }
 
 fn delete_gitea_account(
-    account: &GiteaAccount,
+    account: &but_forge_storage::settings::GiteaAccount,
     storage: &but_forge_storage::Controller,
 ) -> Result<()> {
-    let secret_key = account.secret_key();
-    storage.remove_gitea_account(&account.into())?;
+    storage.remove_gitea_account(account)?;
 
-    static FAIR_QUEUE: Mutex<()> = Mutex::new(());
     let _one_at_a_time_to_prevent_races = FAIR_QUEUE.lock().unwrap();
-    secret::delete(&secret_key, secret::Namespace::BuildKind)
+    secret::delete(account.access_token_key(), secret::Namespace::BuildKind)
 }
 
 fn delete_all_gitea_accounts(storage: &but_forge_storage::Controller) -> Result<()> {
     let keys_to_delete = storage.clear_all_gitea_accounts()?;
-    static FAIR_QUEUE: Mutex<()> = Mutex::new(());
     let _one_at_a_time_to_prevent_races = FAIR_QUEUE.lock().unwrap();
     for key in keys_to_delete {
         secret::delete(&key, secret::Namespace::BuildKind)?;
@@ -183,22 +185,54 @@ fn find_gitea_account(
     account_id: &GiteaAccountIdentifier,
     storage: &but_forge_storage::Controller,
 ) -> Result<Option<GiteaAccount>> {
-    let accounts = storage.gitea_accounts()?;
-    let result = accounts.iter().find_map(|account| {
-        if account.username == account_id.username
-            && account.host == account_id.host
-            && let Some(access_token) = retrieve_gitea_secret(&account.access_token_key)
-                .ok()
-                .flatten()
-        {
-            return Some(GiteaAccount {
-                username: account.username.clone(),
-                host: account.host.clone(),
+    let result = find_persisted_gitea_account(account_id, storage)?.and_then(|account| {
+        retrieve_gitea_secret(account.access_token_key())
+            .ok()
+            .flatten()
+            .map(|access_token| GiteaAccount {
+                username: account.username,
+                host: account.host,
                 access_token,
-            });
-        }
-        None
+            })
     });
 
     Ok(result)
 }
+
+fn find_persisted_gitea_account(
+    account_id: &GiteaAccountIdentifier,
+    storage: &but_forge_storage::Controller,
+) -> Result<Option<but_forge_storage::settings::GiteaAccount>> {
+    Ok(storage
+        .gitea_accounts()?
+        .into_iter()
+        .find(|account| account.username == account_id.username && account.host == account_id.host))
+}
+
+#[cfg(test)]
+mod tests {
+    use tempfile::tempdir;
+
+    use super::{GiteaAccountIdentifier, delete_gitea_access_token};
+
+    #[test]
+    fn delete_removes_metadata_even_if_secret_is_missing() {
+        let tempdir = tempdir().unwrap();
+        let storage = but_forge_storage::Controller::from_path(tempdir.path());
+        storage
+            .add_gitea_account(&but_forge_storage::settings::GiteaAccount {
+                host: "https://codeberg.org".into(),
+                username: "demo".into(),
+                access_token_key: "missing-secret".into(),
+            })
+            .unwrap();
+
+        delete_gitea_access_token(
+            &GiteaAccountIdentifier::new("demo", "https://codeberg.org"),
+            &storage,
+        )
+        .unwrap();
+
+        assert!(storage.gitea_accounts().unwrap().is_empty());
+    }
+}