docs: API token issued+verified — ask 1 answered [#727]

.env.example refs updated (issued 2026-09-02), questions-v1 #1 marked
answered. Material value lives only in ~/.creds/cloudron.env (0600).
Meat: https://projects.knownelement.com/issues/727#note-3928

.env.example

@@ -1,13 +1,10 @@
 # KNEL/cloudron — credential REFS only.
 # Material secrets live in ~/.creds (0600). NEVER commit real values here.
 #
-# Pending founder ask (#685/#727): Cloudron API token.
-# When issued, store the material value in ~/.creds/cloudron.env as:
-#   CLOUDRON_API_TOKEN=<token>
+# Issued 2026-09-02; material value lives in ~/.creds/cloudron.env (0600, never here).
 CLOUDRON_API_TOKEN=
-# Uptime Kuma (monitoring/kuma-cloudron-sync.py) — material value in ~/.creds/uptime-kuma.env
-# UPTIME_KUMA_URL=
-# UPTIME_KUMA_TOKEN=
+CLOUDRON_API_USERNAME=
+CLOUDRON_URL=
 # Uptime Kuma (monitoring/kuma-cloudron-sync.py) — material value in ~/.creds/uptime-kuma.env
 # UPTIME_KUMA_URL=
 # UPTIME_KUMA_TOKEN=

questions-v1.md

@@ -11,10 +11,12 @@ panel API token exists. A token lets the agent use the Cloudron API (apps,
 configs, backups) instead of shell — cleaner audit trail, and the path for
 future AWX/Ansible modules.
 
-- [ ] Create an API token (panel: my.knownelement.com → your profile → API
+- [x] Create an API token (panel: my.knownelement.com → your profile → API
       access, or `cloudron token create` via CLI) with read scope at minimum
-- [ ] Drop the material value in `~/.creds/cloudron.env` as
+      — received 2026-09-02
+- [x] Drop the material value in `~/.creds/cloudron.env` as
       `CLOUDRON_API_TOKEN=<token>` (never in this repo)
+      — stored 0600; verified: profile → mrcharles, apps list → 200
 
 ## 2. docker daemon.json bounce window (see README "Ground truth")