API base + SYSTEM_ADMIN token (or M2M secret) per environment. Tokens stored server-side only (.data).