Cloudron 10.1.5: WordPress apps missing from App Password dropdown, preventing SFTP access

[estudios507]

Hello Cloudron team,

Since the recent Cloudron update, most of my applications no longer appear in Profile → App Passwords → Add app password → App.

I have more than 20 sites, but the dropdown only shows five applications, plus Email (IMAP/SMTP). Previously, my applications appeared in this list.

One affected application is Mailefy:

Cloudron version: 10.1.5

App: WordPress (Developer) 7.1.3

Package: org.wordpress.unmanaged.cloudronapp@3.16.4

The application's SFTP dialog displays the server, port 222, username, and a “Use an app password” link. However, following that link opens the password creation form without Mailefy in the dropdown, so I cannot create its SFTP password.

Steps to reproduce:

Open the affected application's SFTP dialog.

Click “Use an app password”.

Open the App dropdown.

The application is missing.

Expected behavior: Applications that support SFTP should be available when creating an app password.

I found an older report about missing applications in this dropdown, but I do not know whether it is related:
https://forum.cloudron.io/topic/4231/problem-with-app-passwords

Is this a known issue in 10.1.5? Is there a supported workaround, such as creating the app password through the CLI or API?

I can provide screenshots showing the application details, SFTP dialog, and incomplete dropdown.

Thank you.

[james]

Hello @estudios507

@estudios507 said:

One affected application is Mailefy:

This application is neither from the Cloudron app store nor from the community app store, correct?

@estudios507 said:

WordPress (Developer) 7.1.3

Indeed, I reproduced this.
Could not create an app password for @wordpress-developer or @wordpress-managed

[james]

Hello @estudios507

Thanks for reporting.
This is a regression in the Cloudron releases 10.1.4 and 10.1.5 and will be fixed with the next Cloudron release.

---

Solution now? Create app passwords for your apps with the Cloudron API.

Example - INFO: replace the placeholders in the variables with your own details:

(
  CLOUDRON_FQDN="my.DOMAIN.TLD"
  CLOUDRON_API_TOKEN="YOUR_CLOUDRON_API_TOKEN"
  CLOUDRON_APPID="THE_APPID_TO_CREATE_AN_APP_PASSWORD_FOR"
  CLOUDRON_APPPASSWORD_NAME="THE_NAME_OF_THE_APP_PASSWORD"
  curl -X POST "https://${CLOUDRON_FQDN}/api/v1/app_passwords" \
    -H "Authorization: Bearer ${CLOUDRON_API_TOKEN}" \
    -H "Content-Type: application/json" \
    -d "{\"name\": \"${CLOUDRON_APPPASSWORD_NAME}\", \"identifiers\": [\"${CLOUDRON_APPID}\"], \"expirationTime\": null}"
)

Returns:

{
  "id": "THE_USERID_WHO_OWNS_THE_APP_PASSWORD_AND_API_TOKEN",
  "password": "ezct-fyxy-badn-chme"
}

[estudios507]

Hi @james, thank you for confirming the regression and providing the workaround.

I tried your command on Cloudron 10.1.5 using a newly created Read and Write API token from System → Settings → API tokens.

The POST request to /api/v1/app_passwords returns:

{
  "status": "Unauthorized",
  "message": "No such token"
}

However, a GET request to /api/v1/domains using the exact same token and Authorization Bearer header returns HTTP 200. So the token is recognized for that endpoint.

I also recreated the API token and got the same results. The commands were run from my Mac against my Cloudron dashboard domain.

Does /api/v1/app_passwords require a dashboard/CLI login token rather than the API token created in Settings? Or is there another step we are missing in 10.1.5?

Thank you for your guidance.

[james]

Hello @estudios507

@estudios507 said:

Does /api/v1/app_passwords require a dashboard/CLI login token rather than the API token created in Settings?

Yes, that is correct. I tested with the token from my local cloudron cli and just assumed.
Generally most Cloudron API routes are not bound to the user performing the action, but for app password they are bound to a user and that is why it needs a login token (which I used from my local cloudron cli).

[estudios507]

Thank you, @james! Using the login token from Cloudron CLI worked. I successfully created the app password for Mailefy and have confirmed that the SFTP connection works and the drive is mounted. I appreciate your help and the clarification about the token type. We will use this workaround until the dropdown fix is released.

[Supaiku]

I am trying to access sftp for wordpress and now it requires an app password.

I added the user as an operater (though it was already a super admin), yet the wordpress app does not show up in the app password selectbox.

This seems like a bug?

Cloudron version
10.1.5

[james]

Hello @supaiku
This has already been reported and resolved, please see https://forum.cloudron.io/topic/16154/cloudron-10.1.5-wordpress-apps-missing-from-app-password-dropdown-preventing-sftp-access

I am merging the topics.

[Supaiku]

How soon will this next update happen?
Just to see if it's worth setting up the CLI for my task or not.