Basic vs post mismatch
What it means
The server may only accept the secret in the Authorization header (client_secret_basic) or only in the body (client_secret_post), or may decode Basic credentials differently.
Fix
Re-run with the other --auth method to rule this out.
Check it with smart-doctor
Run your login and smart-doctor ranks this cause against the others, with the evidence it found.
npx smart-doctor check my-profile