The bsky.social entryway keeps a stale handle -> DID mapping for months after a handle moves to another account. anders.sorby.xyz still resolved to its previous account there, so the OAuth client's bi-directional handle check rejected the sign-in (issue #5). public.api.bsky.app resolves it correctly and matches the entryway for all current members.