diff --git a/packages/tm-core/src/auth/config.ts b/packages/tm-core/src/auth/config.ts
index 752f0dc2..5f3a2a4e 100644
--- a/packages/tm-core/src/auth/config.ts
+++ b/packages/tm-core/src/auth/config.ts
@@ -6,9 +6,8 @@ import os from 'os';
 import path from 'path';
 import { AuthConfig } from './types';
 
-// Use build-time value if available, otherwise use runtime env or default
+// Single base domain for all URLs
 // Build-time: process.env.TM_PUBLIC_BASE_DOMAIN gets replaced by tsup's env option
-// Runtime: TM_BASE_DOMAIN or HAMSTER_BASE_URL from user's environment
 // Default: https://tryhamster.com for production
 const BASE_DOMAIN =
 	process.env.TM_PUBLIC_BASE_DOMAIN || // This gets replaced at build time by tsup
@@ -16,14 +15,11 @@ const BASE_DOMAIN =
 
 /**
  * Default authentication configuration
- * All URL configuration should be managed here
+ * All URL configuration is derived from the single BASE_DOMAIN
  */
 export const DEFAULT_AUTH_CONFIG: AuthConfig = {
-	// API endpoint for backend services
-	apiBaseUrl: process.env.HAMSTER_API_URL || `${BASE_DOMAIN}/api`,
-
-	// Web URL for OAuth sign-in page
-	webBaseUrl: process.env.HAMSTER_WEB_URL || BASE_DOMAIN,
+	// Base domain for all services
+	baseUrl: BASE_DOMAIN,
 
 	// Configuration directory and file paths
 	configDir: path.join(os.homedir(), '.taskmaster'),
diff --git a/packages/tm-core/src/auth/oauth-service.ts b/packages/tm-core/src/auth/oauth-service.ts
index e886bf01..ec9d67b4 100644
--- a/packages/tm-core/src/auth/oauth-service.ts
+++ b/packages/tm-core/src/auth/oauth-service.ts
@@ -24,7 +24,7 @@ export class OAuthService {
 	private logger = getLogger('OAuthService');
 	private credentialStore: CredentialStore;
 	private supabaseClient: SupabaseAuthClient;
-	private webBaseUrl: string;
+	private baseUrl: string;
 	private authorizationUrl: string | null = null;
 	private originalState: string | null = null;
 
@@ -35,7 +35,7 @@ export class OAuthService {
 		this.credentialStore = credentialStore;
 		this.supabaseClient = new SupabaseAuthClient();
 		const authConfig = getAuthConfig(config);
-		this.webBaseUrl = authConfig.webBaseUrl;
+		this.baseUrl = authConfig.baseUrl;
 	}
 
 	/**
@@ -160,7 +160,7 @@ export class OAuthService {
 			// Start server on localhost only
 			server.listen(port, '127.0.0.1', () => {
 				// Build authorization URL for web app sign-in page
-				const authUrl = new URL(`${this.webBaseUrl}/auth/sign-in`);
+				const authUrl = new URL(`${this.baseUrl}/auth/sign-in`);
 
 				// Encode CLI data as base64
 				const cliParam = Buffer.from(JSON.stringify(cliData)).toString(
@@ -311,12 +311,18 @@ export class OAuthService {
 	 * Get a random available port
 	 */
 	private async getRandomPort(): Promise<number> {
-		return new Promise((resolve) => {
+		return new Promise((resolve, reject) => {
 			const server = http.createServer();
 			server.listen(0, '127.0.0.1', () => {
-				const port = (server.address() as any).port;
+				const address = server.address();
+				if (!address || typeof address === 'string') {
+					reject(new Error('Failed to get port'));
+					return;
+				}
+				const port = address.port;
 				server.close(() => resolve(port));
 			});
+			server.on('error', reject);
 		});
 	}
 
diff --git a/packages/tm-core/src/auth/types.ts b/packages/tm-core/src/auth/types.ts
index 6ab0ce95..557460bb 100644
--- a/packages/tm-core/src/auth/types.ts
+++ b/packages/tm-core/src/auth/types.ts
@@ -42,8 +42,7 @@ export interface OAuthFlowOptions {
 }
 
 export interface AuthConfig {
-	apiBaseUrl: string;
-	webBaseUrl: string;
+	baseUrl: string;
 	configDir: string;
 	configFile: string;
 }