CoreWeave
A AI Object Storage
This card is object storage only. Any OIDC issuer with a discovery document can be exchanged for 30-minute S3-compatible keys (SAML gets up to 12 hours), and CoreWeave recommends exactly that for production. The permanent access keys that still exist have poor hygiene, and creating them requires the static control-plane token graded F on the coreweave-api card.
Docs: docs.coreweave.com · Checked 2026-10-05 · source YAML · dispute via PR
Inbound A
How a workload running anywhere authenticates to this product.
Workload Identity Federation: POST a JWT from any OIDC provider that implements OIDC Discovery (issuer URL configured per org) to api.coreweave.com/v1/cwobject/temporary-credentials/oidc/[ORG-ID] and receive a 30-minute AccessKeyId/SecretAccessKey; SAML assertions yield keys up to 12h.
- Issuers
- any
- docs.coreweave.com checked 2026-09-16
“Exchange OIDC tokens for temporary AI Object Storage credentials using Workload Identity Federation”
- docs.coreweave.com checked 2026-09-16
“Issuer URL: Your OIDC provider's identifier URL, such as https://your-domain.okta.com or https://accounts.google.com.”
- docs.coreweave.com checked 2026-10-05
- docs.coreweave.com checked 2026-09-16
“30-minute lifespan, automatically refreshed”
- docs.coreweave.com checked 2026-09-16
“up to a maximum of 12 hours”
- docs.coreweave.com checked 2026-09-16
“Works with existing identity providers including AWS IAM, GCP Workload Identity, Azure Managed Identities, and custom OIDC providers.”
Documented tutorials cover GitHub Actions and non-CKS Kubernetes clusters; the provider must implement OIDC Discovery and standard claims. WIF only mints credentials; org and bucket access policies (which can reference OIDC group claims) still have to be written separately. Shipped 2025-11-20. A direct exchange of a control-plane API token for 30-minute keys also exists, but that is a static root and would be C on its own. The auth-access/about page returned HTTP 500 on 2026-10-05; its quote was dropped and needs a human to relocate it. The grade rests on the WIF pages, which are unchanged.
Outbound n/a
How this product reaches into your cloud, repos, or other SaaS.
Object storage never needs access to customer infrastructure.
- docs.coreweave.com checked 2026-10-05
Hygiene for any static credential the product still issues
| ✗ Expiry enforceable | Static keys created via CreateAccessKeyFromJWT take durationSeconds; 0 means permanent, otherwise up to 12 hours. No documented default and no org policy to forbid permanent keys, so the "cannot be forced" clause of the rubric applies. Graded conservatively.
|
| ✓ Rotation via API | Keys can be created and revoked through the Object Storage API, but the create call itself authenticates with the static control-plane API Access Token. The llms.txt index no longer carries the revoke-access-keys line that was cited; a human should cite the revocation page directly rather than the index.
|
| ✗ Scoped keys | Access is governed by organization and bucket policies attached to the principal, not to the key; nothing documented lets one key carry fewer permissions than its owner. The quoted policy governs who may create keys, not what a key may do. Graded conservatively.
|
| ✗ Last-used visible | No last-used field is documented on access keys. Audit logging exists for object operations but was not assessed as a per-key last-used signal.
|
| ✗ Leak revocation | CoreWeave is not on GitHub's secret-scanning list.
|
Notes
Home team, graded on the same rubric as everyone else. The A is real and the docs push production users toward it; the remaining tax is that permanent keys are still one API call away, and that call runs on the control-plane token.
Badge
[](https://wif.tax/p/coreweave-object-storage/)