diff --git a/inventcloud/invista/nexus/MFE-URLS.md b/inventcloud/invista/nexus/MFE-URLS.md
new file mode 100644
index 0000000..a79c1ad
--- /dev/null
+++ b/inventcloud/invista/nexus/MFE-URLS.md
@@ -0,0 +1,101 @@
+# MFE Shell — Configuração de Endereços
+
+Referência rápida de onde ficam os endereços no `mfe-shell` (branch `devops`).
+
+> Documentação completa: [`tf_oci_clusters/docs/mfe-architecture.md`](https://dev.azure.com/CN-Squad/Invista%20FIDC%20-%20Nexus/_git/tf_oci_clusters?path=/docs/mfe-architecture.md)
+
+---
+
+## 1. URLs dos MFEs remotos — `public/federation.manifest.json`
+
+Arquivo: `mfe-shell/public/federation.manifest.json`
+
+Este arquivo é lido em runtime pelo `main.ts` (`initFederation('federation.manifest.json')`).
+Diz ao shell onde encontrar o `remoteEntry.json` de cada MFE remoto.
+
+```json
+{
+  "mfe-auth":   "https://localhost:4201/remoteEntry.json",
+  "mfe-user":   "https://localhost:4202/remoteEntry.json",
+  "mfe-person": "https://localhost:4203/remoteEntry.json"
+}
+```
+
+> **Estado atual:** aponta para `localhost` (desenvolvimento local).
+> **Em OCI/produção deve apontar para:** os buckets Object Storage de cada MFE.
+
+**URLs OCI corretas (a aplicar):**
+
+```json
+{
+  "mfe-auth":          "https://objectstorage.sa-saopaulo-1.oraclecloud.com/n/grbb7qzeuoag/b/mfe-auth-dev/o/remoteEntry.json",
+  "mfe-user":          "https://objectstorage.sa-saopaulo-1.oraclecloud.com/n/grbb7qzeuoag/b/mfe-user-dev/o/remoteEntry.json",
+  "mfe-person":        "https://objectstorage.sa-saopaulo-1.oraclecloud.com/n/grbb7qzeuoag/b/mfe-person-dev/o/remoteEntry.json",
+  "mfe-formalization": "https://objectstorage.sa-saopaulo-1.oraclecloud.com/n/grbb7qzeuoag/b/mfe-formalization-dev/o/remoteEntry.json",
+  "mfe-poc":           "https://objectstorage.sa-saopaulo-1.oraclecloud.com/n/grbb7qzeuoag/b/mfe-poc-dev/o/remoteEntry.json"
+}
+```
+
+---
+
+## 2. URLs das APIs backend — `src/app/core/config/environment.service.ts`
+
+Arquivo: `mfe-shell/src/app/core/config/environment.service.ts`
+
+Este serviço é **exposto via federation** (`./EnvironmentService`) para que todos os MFEs remotos
+consumam as URLs de API sem precisar defini-las individualmente.
+
+```typescript
+private config: AppConfig = {
+  production:      false,
+  baseUrl:         'https://llbywpgzxj.execute-api.us-east-2.amazonaws.com/dev/api',
+  authUrl:         'https://llbywpgzxj.execute-api.us-east-2.amazonaws.com/dev/api/auth',
+  userUrl:         'https://04fy406qme.execute-api.us-east-2.amazonaws.com/dev/api/user',
+  personUrl:       'https://qfmruzhrlj.execute-api.us-east-2.amazonaws.com/dev/api/person',
+  userExternalUrl: 'https://04fy406qme.execute-api.us-east-2.amazonaws.com/dev/api/user-external',
+  ssoUrl:          'https://n7u24ds9cg.execute-api.us-east-2.amazonaws.com/dev/api/sso/Auth',
+  version:         '1.0.0',
+  appName:         'Invista App'
+};
+```
+
+> **Estado atual:** aponta para **AWS API Gateway** (us-east-2) — legado.
+> **Pendente:** migrar para `api-gateway-nexus-dev` (OCI, 10.6.0.123).
+
+**URLs OCI corretas (a aplicar):**
+
+| Chave | URL OCI |
+|-------|---------|
+| `baseUrl` | `https://api-dev.invista.com.br/api` |
+| `authUrl` | `https://api-dev.invista.com.br/api/auth` |
+| `userUrl` | `https://api-dev.invista.com.br/api/user` |
+| `personUrl` | `https://api-dev.invista.com.br/api/person` |
+| `userExternalUrl` | `https://api-dev.invista.com.br/api/user-external` |
+| `ssoUrl` | `https://api-dev.invista.com.br/api/sso/Auth` |
+
+> O domínio `api-dev.invista.com.br` é roteado via Cloudflare → LB Test_Crivo_Dev → api-gateway-nexus-dev.
+
+---
+
+## 3. Onde cada MFE usa esses endereços
+
+| MFE | federation.manifest.json | EnvironmentService |
+|-----|--------------------------|--------------------|
+| `mfe-auth` | `remoteEntry.json` do bucket `mfe-auth-dev` | `authUrl`, `ssoUrl` |
+| `mfe-user` | `remoteEntry.json` do bucket `mfe-user-dev` | `userUrl`, `userExternalUrl` |
+| `mfe-person` | `remoteEntry.json` do bucket `mfe-person-dev` | `personUrl` |
+| `mfe-formalization` | `remoteEntry.json` do bucket `mfe-formalization-dev` | `baseUrl` |
+| `mfe-poc` | `remoteEntry.json` do bucket `mfe-poc-dev` | `baseUrl` |
+
+---
+
+## 4. Pendências para funcionar em OCI
+
+- [ ] Atualizar `public/federation.manifest.json` com URLs OCI dos remotes
+- [ ] Atualizar `environment.service.ts` com URLs do `api-gateway-nexus-dev` (OCI)
+- [ ] Configurar DNS Cloudflare: `mfe-*.invista.com.br` e `api-dev.invista.com.br`
+- [ ] VCN peering: vcn-oke ↔ DRG-Invista-Shared (para LB acessar API Gateway MFE)
+
+---
+
+*Atualizado em: 2026-03-01 | Leitura direta do repo mfe-shell (branch devops, Azure DevOps)*
diff --git a/inventcloud/invista/nexus/README.md b/inventcloud/invista/nexus/README.md
index e67f81c..741d64d 100644
--- a/inventcloud/invista/nexus/README.md
+++ b/inventcloud/invista/nexus/README.md
@@ -96,6 +96,7 @@ Cloudflare (*.invista.com.br)
 - [Cloudflare](./CLOUDFLARE.md) — DNS e proxy
 
 ### MFEs
+- [MFE URLs e Endpoints](./MFE-URLS.md) — Onde ficam os endereços no mfe-shell (federation.manifest.json + EnvironmentService)
 - [MFE Padronizacao OCI](./OCI-MFE-PADRONIZACAO.md) — Como todos os 6 MFEs foram migrados para OCI
 - [MFE Tasks / Checklist](./OCI-MFE-TASKS.md) — Status e pendencias
 - [MFE User Pipeline](./MFE-USER-PIPELINE.md) — Detalhe da pipeline mfe-user (multi-cloud legado)