One path from an instance only you reach to a teammate reading it from their own Claude desktop app. Every step uses what the engine ships today.
Add sign-in to this instance:
revetly init --auth
appended revetly.toml (+<TABLES> — kept what was there)
Revetly writes [auth], a grant for the group engineering, and the
endpoint's port, which the engine serves because [auth] is declared.
Open the configuration page. If it is not open, run revetly config and
open the address it prints.
Turn on Advanced settings.
Go to Instance settings > Authentication and approval.
Enter the address your teammate reaches in Resource identifier.
Enter your issuer's address in Issuer.
Select Save.
You should see Saved, not applied on those rows.
Wait for the endpoint to come back.
Read what a hosted client still needs declared:
revetly doctor --offline
[WARN] connect Anthropic/ClaudeAI 1.0.0: Settings -> Connectors -> Add custom connector, with the URL <PUBLIC_URL> …
Revetly ends that line with the exact registration_hosts line to write.
In revetly.toml at the project root, write the line doctor printed:
# revetly.toml
[auth]
registration_hosts = ["claude.ai"]
Revetly still warns on the ChatGPT line until chatgpt.com is added too.
Confirm the issuer registers a client from that host:
revetly doctor
[PASS] client registration <REGISTRATION_ENDPOINT> registered a client at <HOST> …
If it warns, the issuer still holds the allowlist it imported first.
Create your teammate's account at the issuer, in the group engineering.
Send your teammate the connector URL doctor printed.
Have your teammate add that URL as a custom connector in the Claude desktop app.
You should see revetly (as the Claude desktop app shows it)
Have your teammate ask for /revetly-ground.
You should see search_context (as the Claude desktop app shows it)
?v=2 on the end.engineering, or add a grant for
their group under [auth.grants].