benvin/argocd-pkce
main
The Authentik client is now public (iOS app needs it), so Authentik no longer enforces client_secret. PKCE replaces that as the protection against authorization-code interception.