diff --git a/app/README.md b/app/README.md
index 517c78154..5d5e8846d 100644
--- a/app/README.md
+++ b/app/README.md
@@ -87,6 +87,7 @@ From app/:
 
 5) Troubleshooting (Compose)
 - CORS: APP_URL must be http://localhost:3000 so API allows dashboard origin.
+- API base URL: ensure NEXT_PUBLIC_API_URL=http://localhost:8000. If missing, the dashboard may POST to http://localhost:3000 (e.g., /auth/login) and return 404 or CORS errors.
 - Supabase: API requires service role key; anon is only for dashboard.
 - ClickHouse: Use port 8443 with CLICKHOUSE_SECURE=true; ensure your IP is allowlisted in ClickHouse Cloud.
 - Stripe: Optional unless testing billing. If testing webhooks, set NEXT_STRIPE_WEBHOOK_SECRET and run stripe listen.
diff --git a/app/compose.yaml b/app/compose.yaml
index c5b9c5b02..568eb830b 100644
--- a/app/compose.yaml
+++ b/app/compose.yaml
@@ -47,6 +47,7 @@ services:
       SUPABASE_PROJECT_ID: ${SUPABASE_PROJECT_ID}
 
       # Application URLs
+      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
       NEXT_PUBLIC_APP_URL: ${APP_URL}
       NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL}