overview
Why we gave each public surface its own hostname — an API on one, an MCP endpoint on another, the web app on a third — and what that turned out to cost.
The short version: the split is easy, and the thing that makes it hard is that an OAuth resource identifier has to move with the hostname. Get that wrong and every status check stays green while real clients fail at the last step of a handshake.
Worth reading if you are about to put an agent-facing endpoint behind the same host as your REST API. The reasoning transfers; the hostnames do not.