Put this instance's endpoint on an address other people reach, behind a sign-in at an issuer you already run. A caller with no token is redirected there and returns with one.
Open the configuration page. If it is not open, run revetly config and
open the address it prints.
Turn on Advanced settings. Revetly holds every row below behind it, so the section is empty until it is on.
Go to Instance settings > Authentication and approval.
Enter the address people reach in Public address, and the same address in Resource identifier.
Enter your issuer's address in Issuer.
Choose jwt in Token verification method.
Select Save.
You should see Saved, not applied on those rows.
Wait for the endpoint to come back.
Go to This instance and select Test on the endpoint line.
You should see Endpoint: answering at https://revetly.example.com/mcp,
naming the address you declared in step 4.
Read what a caller has to present, before anything is declared:
revetly doctor --offline
[SKIP] caller auth no [auth] in revetly.toml — `revetly serve` answers stdio and loopback, and refuses any other address
In revetly.toml at the project root, declare the address people reach and
the issuer that signs them in:
# revetly.toml
[served]
public_url = "https://revetly.example.com/mcp"
[auth]
issuer = "https://auth.example.com"
resource = "https://revetly.example.com/mcp"
verifier = "jwt"
Revetly refuses any of these unless it is an absolute http or https URL.
Read back what a caller will be checked against:
revetly doctor --offline
[PASS] caller auth [auth] issuer https://auth.example.com, resource …
Check one real token against this endpoint:
revetly doctor --token "$TOKEN"
[PASS] token accepted by <ISSUER>: <PERSON>; grants reach <PROJECT>