diff --git a/README.md b/README.md
index 0ecc7314..ef8e4f25 100644
--- a/README.md
+++ b/README.md
@@ -563,7 +563,7 @@ below.
 - The `Config` exceptions `RuntimeError` and `KeyError` were changed to `ConfigError` exceptions
   from `descarteslabs.exceptions`.
 - `Auth` now retrieves its URL from the `Config` settings. If no valid configuration can be found,
-  it reverts to the commercial service (`https://iam.descarteslabs.com`).
+  it reverts to the commercial service (`https://app.descarteslabs.com`).
 
 ### General
 - Dependencies for the descarteslabs library have been updated, but remain constrained to continue to support Python 3.7.
diff --git a/descarteslabs/auth/auth.py b/descarteslabs/auth/auth.py
index 32ed1669..61db4aca 100644
--- a/descarteslabs/auth/auth.py
+++ b/descarteslabs/auth/auth.py
@@ -119,6 +119,15 @@ class DummyAuth:
     return peek_settings().iam_url
 
 
+def get_app_domain():
+    from descarteslabs.config import peek_settings
+
+    class DummyAuth:
+        payload = {}
+
+    return peek_settings().app_url
+
+
 class Auth:
     """Client used to authenticate with all Descartes Labs service APIs."""
 
diff --git a/descarteslabs/config/settings.toml b/descarteslabs/config/settings.toml
index 1a0595b9..0ff30d93 100644
--- a/descarteslabs/config/settings.toml
+++ b/descarteslabs/config/settings.toml
@@ -8,6 +8,7 @@ default_domain = ""
 default_domain = "@format production.aws.{this.DOMAIN}"
 platform_url = "@format https://platform.{this.DEFAULT_DOMAIN}"
 
+app_url = "@format https://packaged-analytics.production.aws.{this.DOMAIN}"
 catalog_v2_url = "@format {this.PLATFORM_URL}/metadata/v1/catalog/v2"
 compute_url = "@format {this.PLATFORM_URL}/compute/v1"
 iam_url = "@format https://iam.{this.DEFAULT_DOMAIN}"
@@ -21,6 +22,7 @@ yaas_url = "@format {this.PLATFORM_URL}/yaas/v1"
 default_domain = "@format staging.aws.{this.DOMAIN}"
 platform_url = "@format https://platform.{this.DEFAULT_DOMAIN}"
 
+app_url = "@format https://packaged-analytics.production.aws.{this.DOMAIN}"
 catalog_v2_url = "@format {this.PLATFORM_URL}/metadata/v1/catalog/v2"
 compute_url = "@format {this.PLATFORM_URL}/compute/v1"
 iam_url = "@format https://iam.{this.DEFAULT_DOMAIN}"
@@ -34,6 +36,7 @@ yaas_url = "@format {this.PLATFORM_URL}/yaas/v1"
 default_domain = "@format dev.aws.{this.DOMAIN}"
 platform_url = "@format https://platform.{this.DEFAULT_DOMAIN}"
 
+app_url = "@format https://packaged-analytics.production.aws.{this.DOMAIN}"
 catalog_v2_url = "@format {this.PLATFORM_URL}/metadata/v1/catalog/v2"
 compute_url = "@format {this.PLATFORM_URL}/compute/v1"
 iam_url = "@format https://iam.{this.DEFAULT_DOMAIN}"
@@ -47,6 +50,7 @@ yaas_url = "@format {this.PLATFORM_URL}/yaas/v1"
 default_domain = "@format freemium.aws.{this.DOMAIN}"
 platform_url = "@format https://platform.{this.DEFAULT_DOMAIN}"
 
+app_url = "@format https://packaged-analytics.production.aws.{this.DOMAIN}"
 catalog_v2_url = "@format {this.PLATFORM_URL}/metadata/v1/catalog/v2"
 iam_url = "@format https://iam.{this.DEFAULT_DOMAIN}"
 metadata_url = "@format {this.PLATFORM_URL}/metadata/v1"
@@ -58,6 +62,7 @@ default_domain = "@format dev.aws.{this.DOMAIN}"
 platform_url = "@format https://platform.{this.DEFAULT_DOMAIN}"
 testing = true
 
+app_url = "@format https://packaged-analytics.production.aws.{this.DOMAIN}"
 catalog_v2_url = "@format {this.PLATFORM_URL}/metadata/v1/catalog/v2"
 compute_url = "@format {this.PLATFORM_URL}/compute/v1"
 iam_url = "@format https://iam.{this.DEFAULT_DOMAIN}"
@@ -73,6 +78,7 @@ default_domain = "dev.localhost"
 platform_url = "@format https://platform.dev.aws.descarteslabs.com"
 testing = true
 
+app_url = "@format https://packaged-analytics.production.aws.{this.DOMAIN}"
 catalog_v2_url = "@format {this.PLATFORM_URL}/metadata/v1/catalog/v2"
 compute_url = "@format {this.PLATFORM_URL}/compute/v1"
 iam_url = "@format https://{this.DEFAULT_DOMAIN}:8000"
diff --git a/descarteslabs/config/tests/test_config.py b/descarteslabs/config/tests/test_config.py
index 9217ecde..3dc184a8 100644
--- a/descarteslabs/config/tests/test_config.py
+++ b/descarteslabs/config/tests/test_config.py
@@ -135,6 +135,7 @@ def test_env(self):
 class VerifyValues(unittest.TestCase):
     configs = {
         "aws-dev": {
+            "APP_URL": "https://packaged-analytics.production.aws.descarteslabs.com",
             "CATALOG_V2_URL": "https://platform.dev.aws.descarteslabs.com/metadata/v1/catalog/v2",
             "COMPUTE_URL": "https://platform.dev.aws.descarteslabs.com/compute/v1",
             "IAM_URL": "https://iam.dev.aws.descarteslabs.com",
@@ -146,7 +147,18 @@ class VerifyValues(unittest.TestCase):
             "VECTOR_URL": "https://platform.dev.aws.descarteslabs.com/vector/v1",
             "YAAS_URL": "https://platform.dev.aws.descarteslabs.com/yaas/v1",
         },
+        "aws-freemium": {
+            "APP_URL": "https://packaged-analytics.production.aws.descarteslabs.com",
+            "CATALOG_V2_URL": "https://platform.freemium.aws.descarteslabs.com/metadata/v1/catalog/v2",
+            "IAM_URL": "https://iam.freemium.aws.descarteslabs.com",
+            "LOG_LEVEL": "WARNING",
+            "METADATA_URL": "https://platform.freemium.aws.descarteslabs.com/metadata/v1",
+            "PLATFORM_URL": "https://platform.freemium.aws.descarteslabs.com",
+            "RASTER_URL": "https://platform.freemium.aws.descarteslabs.com/raster/v2",
+            "USAGE_URL": "https://platform.freemium.aws.descarteslabs.com/usage/v1",
+        },
         "aws-production": {
+            "APP_URL": "https://packaged-analytics.production.aws.descarteslabs.com",
             "CATALOG_V2_URL": "https://platform.production.aws.descarteslabs.com/metadata/v1/catalog/v2",
             "COMPUTE_URL": "https://platform.production.aws.descarteslabs.com/compute/v1",
             "IAM_URL": "https://iam.production.aws.descarteslabs.com",
@@ -159,6 +171,7 @@ class VerifyValues(unittest.TestCase):
             "YAAS_URL": "https://platform.production.aws.descarteslabs.com/yaas/v1",
         },
         "aws-staging": {
+            "APP_URL": "https://packaged-analytics.production.aws.descarteslabs.com",
             "CATALOG_V2_URL": "https://platform.staging.aws.descarteslabs.com/metadata/v1/catalog/v2",
             "COMPUTE_URL": "https://platform.staging.aws.descarteslabs.com/compute/v1",
             "IAM_URL": "https://iam.staging.aws.descarteslabs.com",
@@ -171,6 +184,7 @@ class VerifyValues(unittest.TestCase):
             "YAAS_URL": "https://platform.staging.aws.descarteslabs.com/yaas/v1",
         },
         "testing": {
+            "APP_URL": "https://packaged-analytics.production.aws.descarteslabs.com",
             "CATALOG_V2_URL": "https://platform.dev.aws.descarteslabs.com/metadata/v1/catalog/v2",
             "COMPUTE_URL": "https://platform.dev.aws.descarteslabs.com/compute/v1",
             "IAM_URL": "https://iam.dev.aws.descarteslabs.com",
diff --git a/descarteslabs/core/client/auth/cli/cli.py b/descarteslabs/core/client/auth/cli/cli.py
index fc1b5f13..203cc5d8 100644
--- a/descarteslabs/core/client/auth/cli/cli.py
+++ b/descarteslabs/core/client/auth/cli/cli.py
@@ -27,11 +27,11 @@
     DESCARTESLABS_TOKEN_INFO_PATH,
     Auth,
     base64url_decode,
-    get_default_domain as get_auth_domain,
+    get_app_domain as get_auth_refresh_domain,
 )
 
 
-LOGIN_URL = f"{get_auth_domain()}/auth/refresh_token"
+LOGIN_URL = f"{get_auth_refresh_domain()}/refresh_token"
 
 
 # this is defined this way to support mocking in the tests