ci: document where to get API keys from

diff --git a/.github/workflows/locale.yml b/.github/workflows/locale.yml
index ef27b54..273006b 100644
--- a/.github/workflows/locale.yml
+++ b/.github/workflows/locale.yml
@@ -39,6 +39,10 @@ jobs:
       - name: Push locale to Crowdin
         # CROWDIN_API_KEY needs to be set in GitHub repository settings
         #   - api key is for crowdin account: "SomberNight_CI_BOT"
+        #     ref https://crowdin.com/settings#api-key
+        #     scope:
+        #       - Projects/"Source files & strings" - read and write
+        #       - Projects/"Translations" - read and write
         env:
           crowdin_api_key: ${{ secrets.CROWDIN_API_KEY }}
         run: ./contrib/locale/push_locale.py
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 43f5fbb..df96be4 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -118,6 +118,8 @@ jobs:
         if: matrix.python == '3.10' && !matrix.debug
         env:
           # 'COVERALLS_REPO_TOKEN' needs to be set in the GitHub repository settings
+          #  This is a "repo token", NOT a "Personal API Token"!
+          #  ref https://coveralls.io/github/spesmilo/electrum/settings
           COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
           CI_NAME: github-actions
           CI_BUILD_NUMBER: ${{ github.run_id }}
@@ -128,7 +130,7 @@ jobs:
         # the repo token will be empty when pull requests from forks get opened
         # so we won't upload on every pull request, but it will run again
         # with the token once the PR gets merged.
-        run: if [ -n "$COVERALLS_REPO_TOKEN" ]; then coveralls; fi
+        run: if [ -n "$COVERALLS_REPO_TOKEN" ]; then coveralls; else echo "missing COVERALLS_REPO_TOKEN"; fi
 
   # unittests using the ~same frozen dependencies that are used in the released binaries
   # note: not using pinned pyqt here, due to "qml_gui" extra