> ## Documentation Index
> Fetch the complete documentation index at: https://docs.valkyrie.vals.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Choose a hosting mode

> Compare hosted and self-hosted Valkyrie deployments.

Valkyrie separates two choices. Hosted or self-hosted determines who operates the tracker and executor host. Managed or access-key AWS determines which AWS account and credentials a run uses. Hosted mode supports both AWS execution modes; eligible organizations default to managed AWS and can configure access keys to run against their own AWS resources instead.

## Hosted mode

Hosted mode uses Vals-managed compute infrastructure. Vals API key authentication isolates data per organization.

### Requirements

* A Vals API key provided by Vals
* Local AWS SDK credentials for direct agent uploads and artifact downloads, including `AWS_PROFILE` with AWS SSO
* A [sandbox-provider secret](/get-started/sandbox-providers)
* For access-key execution, AWS credentials with the [required permissions](/self-hosting/aws-permissions) and an existing S3 bucket

Run configuration and choose **hosted**:

```bash theme={null}
valkyrie config init
```

The CLI validates the Vals API key and configures the organization. When the organization can use managed AWS, it reads the Region and S3 bucket from the tracker instead of asking for access keys.

Set a Vals API key directly when needed:

```bash theme={null}
valkyrie config set api_key <your-vals-api-key>
```

Contact `contact@vals.ai` for hosted access.

### AWS execution mode

The AWS credential fields in the selected config determine the execution mode of new runs.

| Configured fields                                       | Run execution mode                                                                 |
| ------------------------------------------------------- | ---------------------------------------------------------------------------------- |
| Neither `AWS_ACCESS_KEY_ID` nor `AWS_SECRET_ACCESS_KEY` | Managed AWS. The tracker and executor host use deployment task roles.              |
| Both `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`    | Access-key AWS. The tracker receives the configured AWS resources and credentials. |
| Only one access-key field                               | Invalid. Valkyrie stops before sending the request.                                |

Managed execution still allows local AWS operations. Agent uploads and artifact downloads use the local AWS SDK credential chain.

To use access-key AWS in hosted mode, run hosted setup first, then add a complete access-key configuration:

```bash theme={null}
valkyrie config set AWS_ACCESS_KEY_ID <access-key-id>
valkyrie config set AWS_SECRET_ACCESS_KEY <secret-access-key>
valkyrie config set AWS_DEFAULT_REGION <region>
valkyrie config set S3_BUCKET <bucket-name>
valkyrie config set LOG_GROUP <log-group-prefix>
valkyrie config set LOG_RETENTION_POLICY 365
```

Add `valkyrie config set AWS_SESSION_TOKEN <session-token>` for temporary credentials. Return to managed execution by removing the credential fields; the Region and bucket remain for local AWS operations.

```bash theme={null}
valkyrie config remove AWS_ACCESS_KEY_ID
valkyrie config remove AWS_SECRET_ACCESS_KEY
valkyrie config remove AWS_SESSION_TOKEN
```

The tracker stores the AWS execution mode when a run starts. Retrying or resuming a run uses the stored mode rather than the current local config, so an access-key run still requires the access-key configuration it started with.

## Self-hosted mode

Self-hosted mode uses your tracker service and AWS infrastructure.

### Requirements

* A deployed tracker service
* AWS credentials with the [required permissions](/self-hosting/aws-permissions); self-hosted mode always uses access-key execution
* An existing S3 bucket for benchmark artifacts and agents
* A [sandbox-provider secret](/get-started/sandbox-providers)

Point the CLI at your tracker before configuration:

```bash theme={null}
export TRACKER_SERVICE_URL=https://your-tracker.example.com
```

Then run configuration and choose **self-hosted**:

```bash theme={null}
valkyrie config init
```

Self-hosted mode does not use a Vals API key or Descope authentication. The tracker assigns data to its default organization. Review the [infrastructure guide](/self-hosting/infrastructure) before deploying the included AWS CDK application.