I am merging the topics.

I added the user as an operater (though it was already a super admin), yet the wordpress app does not show up in the app password selectbox.

This seems like a bug?

Cloudron version
10.1.5

@estudios507 said:

Does /api/v1/app_passwords require a dashboard/CLI login token rather than the API token created in Settings?

Yes, that is correct. I tested with the token from my local cloudron cli and just assumed.
Generally most Cloudron API routes are not bound to the user performing the action, but for app password they are bound to a user and that is why it needs a login token (which I used from my local cloudron cli).

I tried your command on Cloudron 10.1.5 using a newly created Read and Write API token from System → Settings → API tokens.

The POST request to /api/v1/app_passwords returns:

{
  "status": "Unauthorized",
  "message": "No such token"
}

However, a GET request to /api/v1/domains using the exact same token and Authorization Bearer header returns HTTP 200. So the token is recognized for that endpoint.

I also recreated the API token and got the same results. The commands were run from my Mac against my Cloudron dashboard domain.

Does /api/v1/app_passwords require a dashboard/CLI login token rather than the API token created in Settings? Or is there another step we are missing in 10.1.5?

Thank you for your guidance.

Thanks for reporting.
This is a regression in the Cloudron releases 10.1.4 and 10.1.5 and will be fixed with the next Cloudron release.

Solution now? Create app passwords for your apps with the Cloudron API.

Example - INFO: replace the placeholders in the variables with your own details:

(
  CLOUDRON_FQDN="my.DOMAIN.TLD"
  CLOUDRON_API_TOKEN="YOUR_CLOUDRON_API_TOKEN"
  CLOUDRON_APPID="THE_APPID_TO_CREATE_AN_APP_PASSWORD_FOR"
  CLOUDRON_APPPASSWORD_NAME="THE_NAME_OF_THE_APP_PASSWORD"
  curl -X POST "https://${CLOUDRON_FQDN}/api/v1/app_passwords" \
    -H "Authorization: Bearer ${CLOUDRON_API_TOKEN}" \
    -H "Content-Type: application/json" \
    -d "{\"name\": \"${CLOUDRON_APPPASSWORD_NAME}\", \"identifiers\": [\"${CLOUDRON_APPID}\"], \"expirationTime\": null}"
)

Returns:

{
  "id": "THE_USERID_WHO_OWNS_THE_APP_PASSWORD_AND_API_TOKEN",
  "password": "ezct-fyxy-badn-chme"
}

@estudios507 said:

One affected application is Mailefy:

This application is neither from the Cloudron app store nor from the community app store, correct?

@estudios507 said:

WordPress (Developer) 7.1.3

Indeed, I reproduced this.
Could not create an app password for @wordpress-developer or @wordpress-managed