diff --git a/README.md b/README.md
index 52402e8..7aa188a 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@ cd apps/web
 python3 -m http.server 8080
 ```
 
-Open `http://127.0.0.1:8080`. The UI uses demo data by default; set `window.API_BASE` in the browser console to `http://127.0.0.1:8000` when testing the API locally.
+Open `http://127.0.0.1:8080`. Set `window.API_BASE` in the browser console to `http://127.0.0.1:8000` when testing the authenticated API locally, then sign in with the configured workspace credentials.
 
 ## API smoke calls
 
diff --git a/apps/web/README.md b/apps/web/README.md
index d444260..c84d120 100644
--- a/apps/web/README.md
+++ b/apps/web/README.md
@@ -11,7 +11,7 @@ The API base is configurable before `app.js` runs:
 <script src="app.js"></script>
 ```
 
-If not set, the UI uses `localStorage.prospect_api_base` when present, then renders clearly-labelled demo data. The API contract used by this page is the current MVP contract:
+If not set, the UI uses `localStorage.prospect_api_base` when present; otherwise it targets the same origin. The dashboard requires an authenticated API session and shows the login screen until `/api/v1/auth/me` succeeds. The API contract used by this page is the current MVP contract:
 
 - `GET /api/v1/businesses` (optional filtering is performed client-side)
 - `GET /api/v1/dashboard/summary`