Cloud and self-hosted distinctions

Before choosing deployment path

Use this page before requesting platform access for cloud SaaS, hosted CMS, self-hosted CMS, private-network-constrained or agency-managed environments. The deployment mode determines whether a hosted OAuth/app path, structured request, allowlist check or safe fallback is appropriate. Do not assume a self-hosted or private-network system is reachable. The product should inspect deployment_mode, base_url, private_network_policy and allowlist_status before it asks for connected access or attempts callbacks.

Confirm deployment mode

Follow the path `Project provider → Deployment mode → Network and allowlist check → Access mode or safe fallback`.

1. Open /projects/{project} and review the provider deployment state before requesting access. Result: deployment_mode is visible before any cloud, self-hosted or private-network path is chosen.
2. Confirm whether the provider is cloud, hosted CMS, self-hosted CMS, private-network-constrained or agency-managed. Result: the product can choose hosted OAuth, app install, structured request or fallback path.
3. For self-hosted or private-network systems, check base_url, private_network_policy and allowlist_status. Result: callbacks, workers and provider requests are not attempted until reachability is safe.
4. For cloud or SaaS systems, use the hosted OAuth or app connection path. Result: the customer is not asked for private-network settings that do not apply.
5. Stop when base URL, private network, allowlist or deployment mode is unsafe. Result: Safe fallback paths or Self-hosted connectivity is used before access is requested.
6. Continue to the provider-specific access page only after deployment mode is clear. Result: required scopes and fallback options match the actual customer environment.

Ready deployment states

Continue only when the product shows a clear deployment and network state.

• Cloud ready means the provider supports hosted OAuth, app install or structured cloud access.
• Hosted CMS ready means the site can use the normal CMS or plugin access path without private-network routing.
• Self-hosted reachable means base_url is safe and reachable from the expected worker or callback path.
• Allowlist ready means allowlist_status confirms customer network controls allow the required callbacks or requests.
• Fallback ready means safe fallback is available when connectivity or deployment rules block connected access.

Blocked or unsafe deployment states

Do not work around unsafe deployment state. Use fallback or connectivity troubleshooting before requesting access.

• Unreachable self-hosted provider means stop and use Self-hosted connectivity or Safe fallback paths.
• Unsafe base URL means reject the platform access request until base_url belongs to the customer-owned environment.
• Missing allowlist means configure customer network controls before callbacks or worker access are attempted.
• Private network blocked means do not ask for credentials to bypass the network boundary.
• Wrong deployment mode means restart provider setup so cloud and self-hosted instructions do not mix.
• Agency-managed environment means confirm which customer or agency account owns access before requesting scope.

Continue to provider-specific access

Continue to the provider-specific page after deployment mode is clear: WordPress and WooCommerce access for CMS/theme review, CMP and config access for consent/config review, or Access modes and required scopes for comparing all access choices. Use Safe fallback paths when deployment, private network, allowlist or ownership cannot be verified safely.