---
description: Compare the authentication paths into a self-hosted Watcher deployment.
---

> Part of the Watcher docs. Index of all pages, with summaries: https://watcher-docs.apolloresearch.ai/llms.txt
> Before upgrading Watcher, read the release pages and full changelogs for every version crossed: https://watcher-docs.apolloresearch.ai/releases/index.md
> Found an issue with this page? Report it: https://github.com/ApolloResearch/watcher-bin/issues/new?title=Docs%20feedback%3A%20Deployment%20example&body=Page%3A%20Deployment%20example%0AURL%3A%20https%3A%2F%2Fwatcher-docs.apolloresearch.ai%2Fself-hosting%2Fdeployment-example%2F%0A%0A

# Deployment example

Watcher runs as Docker containers in your environment. These diagrams show two
authentication paths. Both paths lead into the same stack.

For a cluster deployment, see the
[Kubernetes infrastructure example](kubernetes-infrastructure.md). For
Tailscale Aperture and LiteLLM connections, see the
[gateway deployment reference](gateway-deployments.md).

## WorkOS authentication

Your reverse proxy terminates TLS and routes traffic. WorkOS handles login.

![A self-hosted Watcher deployment using WorkOS authentication. Developers and triage users connect through a TLS-terminating reverse proxy to the Analyzer and API. The database, bootstrap container, grading scheduler, and retention cleanup worker remain internal to the stack. The API uses WorkOS for login and identity verification.](/watcher-self-host-architecture.svg)

## Bring your own authentication

Your reverse proxy authenticates each request. It removes untrusted identity
headers. It adds the trusted user and role headers Watcher consumes. Watcher
does not connect to WorkOS on this path.

![A self-hosted Watcher deployment using bring-your-own authentication. Developers and triage users connect through an authenticating reverse proxy that uses the organization's identity provider and injects trusted identity headers into the Analyzer and API. The database, bootstrap container, grading scheduler, and retention cleanup worker remain internal to the stack.](/watcher-self-host-architecture-bring-your-own-auth.svg)

The stack contains these components:

- [Analyzer](../concepts/analyzer.md)
- API
- Database
- Bootstrap container
- Retention cleanup worker
- Grading scheduler (when
  [trailing review](../concepts/blocking-and-trailing-review.md) is enabled)

The retention worker runs continuously. It does two things. First, it deletes
grader inputs. These are inputs that have remained unlinked to a tool-call
decision for more than eight days. Second, it enforces any enabled organization
session-content retention policy.

The session policy is disabled by default. Disabling the policy retains session
content indefinitely.

Organization administrators can enable a period between 7 and 365 days. They
configure this through the Analyzer's
[Data Retention controls](../concepts/organization-settings.md#data-retention)
or the organization settings API.

Both workers run the API image with separate entrypoints.

See [Setup](setup.md) for installation. See [Security](security.md) for data
flows. See [Supply chain security](supply-chain.md) for artifact controls.