1.2 Domain and HTTPS origins

Reserve separate browser and MCP origins under a domain you control. The development profile accepts HTTPS origins such as https://app.example.com and https://mcp.example.com without a path, query or fragment. Record the issuer URL separately because an OIDC realm URL typically has a path.

Arrange DNS and trusted certificates for the endpoints you intend to expose. The external identity service needs a reachable issuer and JWKS endpoint. The packaged topology adds its own Keycloak hostname.

Point public routes at the deployment's authenticated gateway. Keep database and development listener ports private. See DNS, HTTPS and OIDC for preflight checks.