diff --git a/fern/pages/integrations/cli.mdx b/fern/pages/integrations/cli.mdx
index 6a9f4dfc..cf36739a 100644
--- a/fern/pages/integrations/cli.mdx
+++ b/fern/pages/integrations/cli.mdx
@@ -141,6 +141,29 @@ Shell completions (`agentmail completion`) and man pages (`agentmail man`) are b
 - **`--dry-run` is not an acceptance guarantee.** Flag values are type-checked locally, so `--limit abc` fails before a request is made. `--dry-run` then shows the request that would be sent — the API can still reject it on grounds the CLI cannot check, such as an unknown ID or a permission error.
 - **No auto-pagination.** List commands return one page. Paginate manually: pass `--limit`, read `next_page_token` from the response, and pass it back as `--page-token`.
 
+## Upgrading to 1.4
+
+Public keys and AgentID sign-in keys are now API keys, managed with the same `api-keys` commands
+as bearer keys (see [API Keys](/api-reference/api-keys/get)). The commands below called API routes
+that have been removed, so they already fail on 1.3; 1.4 drops them:
+
+| 1.3 | 1.4 |
+| --- | --- |
+| `agentmail api-keys list-public-keys` | `agentmail api-keys list --type public_key` |
+| `agentmail api-keys create-public-key ...` | `agentmail api-keys create --public-key '<jwk>' ...` |
+| `agentmail api-keys update-public-key-name ...` | `agentmail api-keys update --api-key-id <id> --name <name>` |
+| `agentmail api-keys revoke-public-key ...` | `agentmail api-keys delete --api-key-id <id>` |
+| `agentmail api-keys revoke-all-agent-id-sign-in-keys` | `agentmail api-keys delete` for each key |
+| `agentmail inboxes browser-credentials create-enrollment ...` | `agentmail providers connect ...`, or `agentmail inboxes authorize ...` for a sign-in already waiting |
+| `agentmail api-keys list-browser-credentials`, `list-browser-credential-events`, `delete-browser-credential`, `cancel-browser-enrollment` | `agentmail api-keys list`, `get`, and `delete` |
+| `agentmail api-keys list-browser-consents`, `delete-browser-consent` | None: AgentID manages remembered consent |
+
+`agentmail providers connect --authorize` is now `--accept-disclosure`.
+
+New in 1.4: `agentmail inboxes search` and `agentmail pods inboxes search`, `agentmail api-keys get`,
+and `update` under `api-keys`, `inboxes api-keys`, and `pods api-keys`. `agentmail api-keys list`
+takes `--type`, and `agentmail threads get` takes `--limit` and `--page-token`.
+
 ## Upgrading to 1.2
 
 `AGENTMAIL_TOKEN` is no longer read. Versions 1.0 and 1.1 accepted it as an alternative to