diff --git a/tools/gitea.sh b/tools/gitea.sh
index a31d21b..7b73169 100755
--- a/tools/gitea.sh
+++ b/tools/gitea.sh
@@ -17,24 +17,52 @@
 #   gitea.sh repo-set <owner>/<repo> <description> [website]             # 設定 repo 描述與網頁
 #   gitea.sh api <METHOD> <path> [json-file]         # 原始 API 呼叫（path 以 /repos/... 起始）
 # 環境變數: GITEA_HOST（例 https://gitea.jsc.idv.tw）、GITEA_TOKEN
+#   GITEA_TOKEN 未設定，或請求遇 401/403 時，自動退回 tea CLI 的登入 token
+#   （~/.config/tea/config.yml，優先取 default: true 的登入）；兩者皆無才失敗。
 set -eu
 
+tea_token() { # 取 tea CLI 設定檔的 token（優先 default: true 的登入，否則第一個）
+  cfg="${HOME}/.config/tea/config.yml"
+  [ -f "$cfg" ] || return 1
+  t=$(awk '
+    /^ *- /             { if (def && tok != "") { print tok; found=1; exit } tok=""; def=0 }
+    /^ *token: */       { line=$0; sub(/^ *token: */,"",line); gsub(/"/,"",line)
+                          tok=line; if (first=="") first=line }
+    /^ *default: *true/ { def=1 }
+    END { if (!found) { if (def && tok != "") print tok; else print first } }
+  ' "$cfg")
+  [ -n "$t" ] && printf '%s\n' "$t"
+}
+
 : "${GITEA_HOST:?GITEA_HOST is required}"
-: "${GITEA_TOKEN:?GITEA_TOKEN is required}"
+TEA_TOKEN=$(tea_token 2>/dev/null || true)
+if [ -z "${GITEA_TOKEN:-}" ]; then
+  if [ -n "$TEA_TOKEN" ]; then GITEA_TOKEN="$TEA_TOKEN"; else
+    : "${GITEA_TOKEN:?GITEA_TOKEN is required}"
+  fi
+fi
 case "$GITEA_HOST" in http://*|https://*) HOST="$GITEA_HOST" ;; *) HOST="https://$GITEA_HOST" ;; esac
 API="${HOST%/}/api/v1"
 
-req() { # METHOD path [json-file] -> body（HTTP >= 400 時 exit 4）
+req() { # METHOD path [json-file] -> body（HTTP >= 400 時 exit 4；401/403 以 tea token 重試一次）
   method="$1"; path="$2"; body_file="${3:-}"
-  if [ -n "$body_file" ]; then
-    out=$(curl -sS -w '\n%{http_code}' -X "$method" \
-      -H "Authorization: token $GITEA_TOKEN" -H "Content-Type: application/json" \
-      --data-binary "@$body_file" "$API$path")
-  else
-    out=$(curl -sS -w '\n%{http_code}' -X "$method" \
-      -H "Authorization: token $GITEA_TOKEN" "$API$path")
-  fi
-  code=$(printf '%s' "$out" | tail -n1)
+  retried=0
+  while :; do
+    if [ -n "$body_file" ]; then
+      out=$(curl -sS -w '\n%{http_code}' -X "$method" \
+        -H "Authorization: token $GITEA_TOKEN" -H "Content-Type: application/json" \
+        --data-binary "@$body_file" "$API$path")
+    else
+      out=$(curl -sS -w '\n%{http_code}' -X "$method" \
+        -H "Authorization: token $GITEA_TOKEN" "$API$path")
+    fi
+    code=$(printf '%s' "$out" | tail -n1)
+    if [ "$retried" -eq 0 ] && { [ "$code" = 401 ] || [ "$code" = 403 ]; } \
+      && [ -n "$TEA_TOKEN" ] && [ "$TEA_TOKEN" != "$GITEA_TOKEN" ]; then
+      GITEA_TOKEN="$TEA_TOKEN"; retried=1; continue
+    fi
+    break
+  done
   printf '%s\n' "$out" | sed '$d'
   [ "$code" -lt 400 ]
 }