diff --git a/app.js b/app.js
index eec598d..7d41cfb 100644
--- a/app.js
+++ b/app.js
@@ -2,40 +2,26 @@
    Derez — User Portal
    ════════════════════════════════════════════════════════════════ */
 
-/* ─── Webhook URLs ──────────────────────────────────────────── */
-const SIGNUP_URL =
-  "https://n8n.derez.ai/webhook/4de196b7-2ad2-4f9a-9b4d-dc8d3b30865b";
-const AGENTS_URL =
-  "https://n8n.derez.ai/webhook/73b31740-d2c7-46d7-ab71-7a3fef5f77ff";
-const KEYS_URL =
-  "https://n8n.derez.ai/webhook/1f1a6a11-727b-4965-a59a-fde77806d27f";
-const PASSWORD_URL =
-  "https://n8n.derez.ai/webhook/51098cf4-ecfd-4db4-8977-db04f01ce2b1";
-const RESTART_URL =
-  "https://n8n.derez.ai/webhook/dac205df-66e0-4728-90e5-d784cde167af";
-const BACKUP_LIST_URL =
-  "https://n8n.derez.ai/webhook/30eaa32f-378a-4963-9d80-533229d25766";
-const BACKUP_URL =
-  "https://n8n.derez.ai/webhook/30eaa32f-378a-4963-9d80-533229d25766";
-const AGENT_INFO_URL =
-  "https://n8n.derez.ai/webhook/e01d06a3-14c3-4e4e-830f-7d4be9a5f529";
-const CHAT_URL =
-  "https://n8n.derez.ai/webhook/a58d00c4-f0c9-40cd-bb50-4f45f0442ef0";
-const REFERRAL_URL =
-  "https://n8n.derez.ai/webhook/5bb4169d-284a-4006-8952-fcc325da2d22";
-const CONTRACT_URL =
-  "https://n8n.derez.ai/webhook/18591766-147e-4bcb-b9ac-b0f9a92e74bf";
+/* ─── API Base & Endpoints ───────────────────────────────────── */
+const API_BASE = "https://admin.derez.ai/api";
+
+const AUTH_URL = `${API_BASE}/account/login`; // POST (sign in), DELETE (sign out)
+const AGENTS_URL = `${API_BASE}/agent/list`; // GET ?email=
+const AGENT_INFO_URL = `${API_BASE}/agent/info`; // GET ?uuid=  |  POST {uuid,key,value}
+const KEYS_URL = `${API_BASE}/agent/key`; // GET ?uuid=
+const PASSWORD_URL = `${API_BASE}/agent/password`; // POST {uuid,email,password}
+const RESTART_URL = `${API_BASE}/agent/service/restart`; // POST {uuid,email,action:"restart"}
+const BACKUP_URL = `${API_BASE}/agent/service/backup`; // GET ?uuid=  |  POST {uuid}  |  PUT restore
+const CONTRACT_URL = `${API_BASE}/account/contract`; // GET ?uuid=
+const ACCOUNT_PASSWORD_URL = `${API_BASE}/account/password/change`; // POST {email,password}
+const PW_RESET_URL = `${API_BASE}/account/password/init_change`; // POST {email}
+const SIGNUP_URL = `${API_BASE}/etc/signup`; // POST {email,password,agent,location}
+const COUPON_URL = `${API_BASE}/etc/coupon`; // POST {code}
+const CHAT_URL = `${API_BASE}/etc/chat`; // POST {message,sessionId,email}
+const REFERRAL_URL = `${API_BASE}/etc/referral`; // POST {referrer,friend_name,friend_email,uuid}
+// WIZZARD=false is written via AGENT_INFO_URL (POST { uuid, key, value })
 const CONTRACT_EXTEND_URL = "https://derez.ai"; // ← replace with Stripe payment link
 const CONTRACT_CANCEL_URL = "https://derez.ai"; // ← replace with Stripe cancellation link
-const COUPON_URL =
-  "https://n8n.derez.ai/webhook/fd6375cb-6d73-4482-bfa3-ef8365f43a67";
-// WIZZARD=false is written via AGENT_INFO_URL (POST { uuid, key, value })
-const AUTH_URL =
-  "https://n8n.derez.ai/webhook/e256310a-6627-45ba-a221-599751943fe6";
-const ACCOUNT_PASSWORD_URL =
-  "https://n8n.derez.ai/webhook/4644f196-a31c-4d1a-b76e-03e9afe39302";
-const PW_RESET_URL =
-  "https://n8n.derez.ai/webhook/c2ce0eba-eb26-405d-8a90-8d982ec30698";
 
 /* ─── State ─────────────────────────────────────────────────── */
 let currentEmail = null;
@@ -1087,7 +1073,7 @@ async function loadBackups(uuid) {
   body.innerHTML = '<div class="loading-row"><div class="spinner"></div></div>';
 
   try {
-    const _backupsUrl = `${BACKUP_LIST_URL}?uuid=${encodeURIComponent(uuid)}`;
+    const _backupsUrl = `${BACKUP_URL}?uuid=${encodeURIComponent(uuid)}`;
     dbg("→ List Backups", _backupsUrl);
     const res = await apiFetch(_backupsUrl);
     if (!res.ok) throw new Error(`HTTP ${res.status}`);
@@ -1194,7 +1180,7 @@ async function restoreBackup(backup) {
   try {
     dbg("→ Restore Backup", BACKUP_URL);
     const res = await apiFetch(BACKUP_URL, {
-      method: "POST",
+      method: "PUT",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
         uuid: activeUUID,
diff --git a/password.html b/password.html
index ee01161..a50cf22 100644
--- a/password.html
+++ b/password.html
@@ -810,7 +810,7 @@
         <script>
             /* ─── Constants ────────────────────────────────────── */
             const RESET_URL =
-                "https://n8n.derez.ai/webhook/c2ce0eba-eb26-405d-8a90-8d982ec30698/update";
+                "https://admin.derez.ai/api/account/password/change";
             const APP_URL = "https://app.derez.ai";
 
             /* ─── Extract token + email from URL ──────────────── */
@@ -909,7 +909,7 @@
 
                 try {
                     const res = await fetch(RESET_URL, {
-                        method: "POST",
+                        method: "PUT",
                         headers: { "Content-Type": "application/json" },
                         body: JSON.stringify({ token, password, email }),
                     });