1 files changed, 19 insertions, 5 deletions

diff --git a/internal/config/README.md b/internal/config/README.md
index dbb8760..7deb38f 100644
--- a/internal/config/README.md
+++ b/internal/config/README.md
@@ -90,12 +90,25 @@ auth:
   # Timestamp window in seconds for replay protection
   timestamp_window: 60
 
-  # Allowed npubs (optional, whitelist)
-  # If empty, all valid signatures are accepted
+  # Allowed npubs for read operations (optional, whitelist)
+  # If empty, all valid signatures are accepted for reads
   # Use npub format only (e.g., npub1...)
-  allowed_npubs: []
+  allowed_npubs_read: []
+
+  # Allowed npubs for write operations (optional, whitelist)
+  # If empty, all valid signatures are accepted for writes
+  # Use npub format only (e.g., npub1...)
+  allowed_npubs_write: []
+
+  # Example use cases:
+  # - Public relay: allowed_npubs_write (only some can publish), empty read (everyone can read)
+  # - Private relay: both lists populated (restricted read and write)
+  # - Open relay: both lists empty (everyone can read and write)
+  #
   # Example:
-  # allowed_npubs:
+  # allowed_npubs_read:
+  #   - npub1a2b3c4d5e6f...
+  # allowed_npubs_write:
   #   - npub1a2b3c4d5e6f...
 
   # Skip authentication for these methods
@@ -222,7 +235,8 @@ Complex types:
 
 ```bash
 # Lists (comma-separated, npub format)
-export MUXSTR_AUTH_ALLOWED_NPUBS="npub1...,npub1...,npub1..."
+export MUXSTR_AUTH_ALLOWED_NPUBS_READ="npub1...,npub1..."
+export MUXSTR_AUTH_ALLOWED_NPUBS_WRITE="npub1..."
 
 # Durations
 export MUXSTR_SERVER_READ_TIMEOUT="30s"