diff --git a/README.md b/README.md
index d1297e1..05621bb 100644
--- a/README.md
+++ b/README.md
@@ -143,7 +143,15 @@ The CLI source is MIT licensed. The hosted Pushman service, iPhone app, monthly
 
 ## Configuration
 
-The production API is `https://api.pushman.whitekiwi.link/v1`. For local development, an explicit loopback override is supported:
+The source default targets the live service at `https://api.pushman.io/v1`.
+Client publication remains separate; existing releases default to
+`https://api.pushman.whitekiwi.link/v1`. Set `PUSHMAN_API_URL=https://api.pushman.io/v1`
+in each CLI and local MCP process until using a release with the updated default.
+The new endpoint requires `pushman login` again. Credentials are scoped to the API base: login and
+logout at the new endpoint preserve the old endpoint's keyring entry. There is no
+automatic credential copy or fallback to the previous API.
+
+For local development, an explicit loopback override is supported:
 
 ```sh
 make pdev ARGS=status
diff --git a/api/openapi.yaml b/api/openapi.yaml
index 5b2387b..fa4d003 100644
--- a/api/openapi.yaml
+++ b/api/openapi.yaml
@@ -7,7 +7,7 @@ info:
     name: MIT
     identifier: MIT
 servers:
-  - url: https://api.pushman.whitekiwi.link/v1
+  - url: https://api.pushman.io/v1
     description: Production API origin.
 security:
   - bearerAuth: []
diff --git a/cmd/pushman/main_test.go b/cmd/pushman/main_test.go
index a3a6ff1..8dece51 100644
--- a/cmd/pushman/main_test.go
+++ b/cmd/pushman/main_test.go
@@ -1,8 +1,13 @@
 package main
 
 import (
+	"errors"
 	"runtime/debug"
 	"testing"
+
+	pushclient "github.com/pushmanhq/pushman-cli/internal/client"
+	"github.com/pushmanhq/pushman-cli/internal/credential"
+	keyring "github.com/zalando/go-keyring"
 )
 
 func TestResolveVersionInfoUsesModuleAndVCSMetadata(t *testing.T) {
@@ -54,3 +59,30 @@ func TestCredentialServiceNameSeparatesDevelopmentCredentials(t *testing.T) {
 		t.Fatalf("development credential service = %q", development)
 	}
 }
+
+func TestMigratedEndpointRequiresAnIndependentKeyringLogin(t *testing.T) {
+	keyring.MockInit()
+	old := credential.NewKeyring(credentialServiceName("https://api.pushman.whitekiwi.link/v1", ""))
+	target := credential.NewKeyring(credentialServiceName(pushclient.DefaultBaseURL, ""))
+	if err := old.Set("synthetic-old-endpoint-token"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := target.Get(); !errors.Is(err, credential.ErrNotFound) {
+		t.Fatal("new endpoint reused an existing endpoint credential")
+	}
+	if err := target.Set("synthetic-new-endpoint-token"); err != nil {
+		t.Fatal(err)
+	}
+	if token, err := old.Get(); err != nil || token != "synthetic-old-endpoint-token" {
+		t.Fatal("new login changed the original endpoint credential")
+	}
+	if err := target.Delete(); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := target.Get(); !errors.Is(err, credential.ErrNotFound) {
+		t.Fatal("new endpoint logout did not clear its own credential")
+	}
+	if token, err := old.Get(); err != nil || token != "synthetic-old-endpoint-token" {
+		t.Fatal("new endpoint logout changed the original endpoint credential")
+	}
+}
diff --git a/internal/client/client.go b/internal/client/client.go
index 2763435..273bd27 100644
--- a/internal/client/client.go
+++ b/internal/client/client.go
@@ -17,7 +17,7 @@ import (
 	"github.com/pushmanhq/pushman-cli/internal/credential"
 )
 
-const DefaultBaseURL = "https://api.pushman.whitekiwi.link/v1"
+const DefaultBaseURL = "https://api.pushman.io/v1"
 
 type WaitFunc func(context.Context, time.Duration) error