diff --git a/docs/deploy-and-configure/configuration/production-ready-settings/index.md b/docs/deploy-and-configure/configuration/production-ready-settings/index.md
index cc6942189..5577dad5a 100644
--- a/docs/deploy-and-configure/configuration/production-ready-settings/index.md
+++ b/docs/deploy-and-configure/configuration/production-ready-settings/index.md
@@ -20,6 +20,14 @@ As valid-logout-redirect-uri we suggest the base basic URL of your deployment. e
 Once you restrict these URLs in Keycloak you might see error messages in your keycloak log indicating that those redirect uri's are not valid.
 Please update the settings accordingly.
 
+For fine granular set the Root URL to you base like `https://cmem.example.net` . Then add these to the clients, depending on the purpose:
+
+- For Explore: `/dataplatform/login/oauth2/code/keycloak`
+- For DataIntegration/Build: `/dataintegration/login`
+- For Marketplace: `marketplace/auth/callback`
+- For Graph Insights: `/graphinsights/login/oauth2/code/keycloak`
+
+
 ![Keycloak: Client Settings: Valid Redirect URLs](23-1-keycloak-client-settings.png)
 
 ### Explore backend (DataPlatform) valid post redirect settings