[bug] Trakt “Own app” connection requires a Client Secret, which Trakt no longer issues for new apps #1497

CrossWatch version

0.13.5

Interface

Web user interface

Providers involved

• AniList
• BingeBase
• CrossWatch
• Emby
• FlickList
• Floppy
• Jellyfin
• Kodi
• MDBList
• Nuvio
• Plex
• PublicMetaDB
• PunchPlay
• Scrob
• SIMKL
• Stremio
• Tautulli
• Tracearr
• TMDb
• Trakt
• WeTrakr

Affected area

• Watchlist
• History
• Progress or Playback progress
• Ratings
• Collections
• Scrobble (watcher/webhook)
• Scheduler
• Analyzer
• Events
• Import/Export
• Metadata or IDs
• Web UI
• Command line interface
• Configuration or API

What happened?

The Trakt "Own app (Client ID)" connection form has a Client Secret field that appears to be mandatory, but Trakt no longer issues a client secret for newly created apps. The app page on developer.trakt.tv shows "Not issued. This app signs users in with PKCE", so there is nothing to enter and no way to complete the connection with a new app.

Expected: own-app mode should work with only a Client ID (using PKCE if needed), since Trakt now treats client_secret as optional and deprecated on its /oauth endpoints.

How can we reproduce it?

1. Create a new Trakt app at developer.trakt.tv/apps with redirect URI urn:ietf:wg:oauth:2.0:oob, as the connection modal instructs.
2. Open the app page. Client Secret shows "Not issued".
3. In CrossWatch, go to Settings → Connections → Add provider → Trakt → Own app (Client ID).
4. Enter the Client ID. The Client Secret field has nothing to fill. Clicking "Connect Trakt" has no effect.

Sync Output debug log

No response

Analyzer output

No response

Additional context

Trakt's change: trakt/trakt-api#974 (client_secret is now optional/deprecated on /oauth, PKCE recommended).

Confirmation

• I removed tokens, API keys, passwords, usernames, and other sensitive information.