# Cloud and on-premises

Location: [gRPC API](https://developer.m-files.com/APIs/gRPC-API/index.md) > [Runtime conventions](https://developer.m-files.com/APIs/gRPC-API/index.md#runtime)

HTML version: https://developer.m-files.com/APIs/gRPC-API/runtime/deployments/

The API, the messages and the session model are the same everywhere. What differs is how you
reach the server and how users authenticate.

| | M-Files Cloud | On-premises |
|---|---|---|
| Address | The vault host on port 443, for example `contoso.cloudvault.m-files.com:443` | The server's host name and the gRPC port, 7766 by default |
| Transport | TLS, publicly trusted certificate | Plain HTTP/2 by default; TLS when the administrator enables it, with the certificate they install |
| Front end | A front end between client and server; several server instances can serve one vault | The client talks to M-Files Server directly, or to the M-Files reverse proxy (Traefik) where one is deployed |
| Stickiness | The front end sets the cookie `mfilesmsm`; send it back on later calls | None |
| Typical authentication | Single sign-on through M-Files Login Service (plugin `MFLoginService.Default`), which M-Files Cloud vaults are moving to; otherwise through the vault's identity provider. Both are `AUTH_DATA_TYPE_PLUGIN` with a token | M-Files user name and password, Windows authentication, or single sign-on where configured |
| Login accounts | Vault-level login accounts (`vault_login_accounts` capability) | Server-level login accounts unless configured otherwise |
| Server version | Chosen by M-Files; check it with `QueryVersion` | Whatever version the customer runs |
| mf-http-grpc gateway | Same host, port 443, paths `/grpc/v1/...` | Port 7767 by default |

## Practical consequences

* **Find the authentication method first.** Call
  [GetAuthenticationConfiguration](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLogin/GetAuthenticationConfiguration/index.md)
  anonymously with `host_name` set to the host you connect to. On an M-Files Cloud vault it returns
  `AUTH_METHOD_PLUGIN` and the OAuth plugin with its identity provider settings and the vault
  GUID. When the plugin is `MFLoginService.Default`, sign in through M-Files Login Service: see
  [M-Files Login Service](https://developer.m-files.com/APIs/gRPC-API/runtime/authentication/index.md#m-files-login-service). Other plugins: see
  [Single sign-on](https://developer.m-files.com/APIs/gRPC-API/runtime/authentication/index.md#single-sign-on-plugin-authentication).
* **Keep cookies on M-Files Cloud.** Store `set-cookie` values from response headers and send them
  in a `cookie` header on every later call of the session. See
  [Call metadata](https://developer.m-files.com/APIs/gRPC-API/runtime/call-metadata/index.md#cookies-and-stickiness).
* **Trust the right certificate on-premises.** A server with a private or self-signed
  certificate needs its CA in your client; a server without TLS needs an insecure channel. See
  [Connecting](https://developer.m-files.com/APIs/gRPC-API/runtime/connecting/index.md#tls).
* **Do not hard-code capabilities.** Cloud and on-premises servers run different versions. Use
  [QueryVersion](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCQueryVersion/QueryVersion/index.md) and
  [GetServerCapabilities](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLogin/GetServerCapabilities/index.md); see
  [Versions and compatibility](https://developer.m-files.com/APIs/gRPC-API/runtime/versioning/index.md).

## The same first call everywhere

Both deployments answer [QueryVersion](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCQueryVersion/QueryVersion/index.md) without a
session or any metadata:

| Target | Channel | Example answer |
|---|---|---|
| `contoso.cloudvault.m-files.com:443` | TLS, default trust | `server_version` 7318389121155072 (26.9.16357.0) |
| `mfserver.example.local:7766` | Insecure (or TLS with your CA) | `server_version` 7318397729964032 (26.11.16645.0) |

The [Connecting](https://developer.m-files.com/APIs/gRPC-API/runtime/connecting/index.md#is-the-server-reachable) page explains how to decode the version
and what a failure means.