First run credentials come from APP_USERNAME / APP_PASSWORD env vars.