diff --git a/.env.example b/.env.example
index 8bd73db..240a2e9 100644
--- a/.env.example
+++ b/.env.example
@@ -1,13 +1,10 @@
 # KNEL/cloudron — credential REFS only.
 # Material secrets live in ~/.creds (0600). NEVER commit real values here.
 #
-# Pending founder ask (#685/#727): Cloudron API token.
-# When issued, store the material value in ~/.creds/cloudron.env as:
-#   CLOUDRON_API_TOKEN=<token>
+# Issued 2026-09-02; material value lives in ~/.creds/cloudron.env (0600, never here).
 CLOUDRON_API_TOKEN=
-# Uptime Kuma (monitoring/kuma-cloudron-sync.py) — material value in ~/.creds/uptime-kuma.env
-# UPTIME_KUMA_URL=
-# UPTIME_KUMA_TOKEN=
+CLOUDRON_API_USERNAME=
+CLOUDRON_URL=
 # Uptime Kuma (monitoring/kuma-cloudron-sync.py) — material value in ~/.creds/uptime-kuma.env
 # UPTIME_KUMA_URL=
 # UPTIME_KUMA_TOKEN=
diff --git a/questions-v1.md b/questions-v1.md
index 28d9355..a901634 100644
--- a/questions-v1.md
+++ b/questions-v1.md
@@ -11,10 +11,12 @@ panel API token exists. A token lets the agent use the Cloudron API (apps,
 configs, backups) instead of shell — cleaner audit trail, and the path for
 future AWX/Ansible modules.
 
-- [ ] Create an API token (panel: my.knownelement.com → your profile → API
+- [x] Create an API token (panel: my.knownelement.com → your profile → API
       access, or `cloudron token create` via CLI) with read scope at minimum
-- [ ] Drop the material value in `~/.creds/cloudron.env` as
+      — received 2026-09-02
+- [x] Drop the material value in `~/.creds/cloudron.env` as
       `CLOUDRON_API_TOKEN=<token>` (never in this repo)
+      — stored 0600; verified: profile → mrcharles, apps list → 200
 
 ## 2. docker daemon.json bounce window (see README "Ground truth")