CoreWeave

F Control-plane API (api.coreweave.com, Terraform provider, kubeconfigs)

This card is the control plane only: the API that creates CKS clusters and VPCs, the Terraform provider, and managed-auth kubeconfigs. Its one credential is a static, user-scoped API Access Token minted by hand in the Cloud Console, with almost no hygiene around it. CoreWeave's CKS and AI Object Storage cards grade very differently; see those.

Docs: docs.coreweave.com · Checked 2026-10-05 · source YAML · dispute via PR

Inbound F

How a workload running anywhere authenticates to this product.

A static, user-scoped API Access Token created in the Cloud Console (CW-SECRET-... via COREWEAVE_API_TOKEN for Terraform); no federation path exists into api.coreweave.com.

docs.coreweave.com checked 2026-09-16
“API Access Tokens are user-scoped tokens that grant users permission to access API endpoints. They gate the ability to deploy CKS Clusters, VPCs, and to manage and access cluster metrics.”
docs.coreweave.com checked 2026-09-17
“This page explains how to create, use, and manage API Access Tokens and the kubeconfig files generated alongside them, so you can authenticate kubectl to CKS clusters and keep credentials secure.”
docs.coreweave.com checked 2026-09-16
“Managed auth uses CoreWeave-issued API access tokens against the managed-auth endpoint”
docs.coreweave.com checked 2026-10-05
“Replace {API_ACCESS_TOKEN} in the examples on each operation page with your CoreWeave API access token.”

Nothing in the token docs, the CKS API reference, or the Object Storage WIF docs describes exchanging an external OIDC/SAML token for a control-plane token; Object Storage's WIF explicitly "only generates temporary credentials" for Object Storage. So the Terraform provider and every cluster/VPC create call run on a long-lived Console token, and 1 of 5 hygiene checks passes. The rewritten CKS API reference still authenticates with a bearer API access token and now points at a separate IAM Access Policies page for required permissions; that page has not been read and is not yet evidence either way. The CKS clusters this API creates, and AI Object Storage, both accept federated identities and are graded on their own cards.

Outbound n/a

How this product reaches into your cloud, repos, or other SaaS.

The control plane never needs access to customer infrastructure.

docs.coreweave.com checked 2026-10-05
“REST and gRPC API for creating, listing, updating, and deleting CoreWeave CKS clusters.”

The CKS API exposes only cluster list/create/get/delete/update; no integration pulls from a customer cloud. Per-cluster OIDC issuance is graded on the CKS card.

Hygiene for any static credential the product still issues

✓ Expiry enforceable	Every API Access Token carries an expiration set at creation. The docs do not state the default, the maximum, whether "never" is selectable, or whether an org policy can cap it; passed on the documented statement that tokens have an expiration date. docs.coreweave.com checked 2026-09-16 “Expiration How long the token remains valid.” docs.coreweave.com checked 2026-09-16 “Tokens have an expiration date, so a token that worked previously can expire between sessions.”
✗ Rotation via API	Tokens are created and deleted only in the Cloud Console; the rewritten CKS API reference lists five endpoints, all of them cluster CRUD, and no token endpoints. Rotation means a human in a browser. docs.coreweave.com checked 2026-09-16 “You can view or delete Access Tokens on the Access Tokens dashboard” docs.coreweave.com checked 2026-10-05 “The API lets you create, list, update, and delete managed Kubernetes clusters on CoreWeave infrastructure.”
✗ Scoped keys	A token is the user; there is no way to restrict one to a cluster, a namespace, or a subset of the user's org permissions. The CKS API reference now refers to IAM Access Policies for required permissions, which may describe a scoped machine principal; that page is not cited here and the check is held at fail until it is read. docs.coreweave.com checked 2026-09-16 “user-scoped and grant permissions to deploy CKS clusters and VPCs, access cluster metrics, and authenticate against the managed-auth endpoint.”
✗ Last-used visible	No last-used timestamp is documented for API Access Tokens in the token management or support pages. Graded conservatively. docs.coreweave.com checked 2026-09-16 docs.coreweave.com checked 2026-09-16
✗ Leak revocation	CoreWeave does not appear in GitHub's supported secret-scanning patterns, partner or otherwise, despite tokens having a greppable CW-SECRET- prefix. The page has been reorganized and the fetched text returned navigation only; the pattern table was not reachable, so the fail stands on the prior reading and a human should re-read the table. docs.github.com checked 2026-10-05

Notes

Home team, graded on the same rubric as everyone else. The fix is a federated path into api.coreweave.com (exchange an OIDC token for a short-lived control-plane token, the way Object Storage already does), then an API to mint and revoke tokens, token scoping, a last-used column, and a GitHub secret-scanning partnership.

Badge

[![wif.tax grade](https://wif.tax/badge/coreweave-api.svg)](https://wif.tax/p/coreweave-api/)