Introduction

A managed deployment runs your code on Mistral Cloud. You point Studio at your code, and Mistral builds, runs, scales, and recovers it. You never manage servers, and you never put an API key in your code: the platform injects a rotating service-account token into the workload.

Managed deployments cover the three things you build in Studio (agents, workflows, and apps) with the same lifecycle: deploy, verify, update, observe. To try it, follow Quickstart: deploy a workflow to Mistral.

To deploy a model rather than an agent, workflow, or app, see Inference > Deployment.

Every managed deployment works through three mechanisms:

• Build: Mistral Cloud builds your code into a runnable image.
• Authentication: each deployment runs under its own service account. The platform injects a rotating token, and the SDK reads it and handles rotation. Your code never touches credentials.
• Injection: the platform sets the deployment name and the server URL, so the workload connects and registers without configuration.

The specifics (which repository the image is built from, which command starts the workload, how secrets are bound) differ per system and are covered on each system's page.

Configure environment variables on the deployment. For credentials, use the workspace Secrets Manager: bind a secret to an environment variable, and the workload reads the value from its environment at boot. The deployment configuration stores the reference, never the value.

Secret values are resolved when the workload starts. To pick up a changed value, restart the deployment.

• Workflows: public preview.