diff --git a/package.json b/package.json
index 2f3c95a..5e7d556 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@agent-score/sdk",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "TypeScript client for the AgentScore APIs",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
diff --git a/src/types.ts b/src/types.ts
index 2ae0db3..1b73f17 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -231,9 +231,9 @@ export type DenialCode =
   | 'wallet_not_trusted'
   | 'api_error'
   | 'payment_required'
-  // Merchant-emitted convenience codes (e.g. martin-estate's onDenied wraps gate denials
-  // into wine-specific business codes). These are not emitted by the AgentScore API
-  // itself but appear in 4xx bodies the SDK may surface back to callers.
+  // Merchant-emitted convenience codes — not emitted by the AgentScore API itself,
+  // but they may appear in 4xx bodies that pass through the SDK from merchants whose
+  // gate `onDenied` hook wraps AgentScore denials into business-domain codes.
   | 'operator_verification_required'
   | 'compliance_denied'
   | 'compliance_error'
diff --git a/tests/integration.test.ts b/tests/integration.test.ts
index 26ce402..47381d4 100644
--- a/tests/integration.test.ts
+++ b/tests/integration.test.ts
@@ -2,10 +2,11 @@ import { beforeAll, describe, expect, it } from 'vitest';
 import { AgentScore } from '../src/index';
 
 const API_KEY = process.env.AGENTSCORE_API_KEY;
-const BASE_URL = process.env.AGENTSCORE_BASE_URL || 'http://api.dev.agentscore.internal';
+const BASE_URL = process.env.AGENTSCORE_BASE_URL;
 const TEST_ADDRESS = '0x339559a2d1cd15059365fc7bd36b3047bba480e0';
 
-const describeIf = API_KEY ? describe : describe.skip;
+// Both must be set for integration tests to run — no default to a private endpoint.
+const describeIf = (API_KEY && BASE_URL) ? describe : describe.skip;
 
 describeIf('integration: real API', { timeout: 15_000 }, () => {
   let client: AgentScore;