I also have this issue in 2023.4.1. I followed the example addon to a T, added config options for api access and I changed run to print the environment variables.
As @tpickle-py said, the solution seems to be to wrap the app you start inside your container with /usr/bin/with-contenv. That is where the SUPERVISOR_TOKEN env var is set.
The examples do this with that hashbang in run.sh, but if you are like me and rewrote it without that script, this detail is easily overlooked!
This prolly also means we can remove most of the extra perms we added in config.yaml to get this to work, depending on your needs of course:
hassio_role: admin # Remove, or change to "default"
host_network: true # Remove, unless your app needs direct access