Genesis Cloud

F Genesis Cloud (Compute API, Object Storage, Inference Service)

The Compute API, Terraform provider, S3-compatible Object Storage and Inference API all take static secrets created by hand in the console's Keys and Tokens page. Genesis says a token has full access to the account. No expiry, token API, last-used view or GitHub partner revocation is documented, and there is no OIDC path. Genesis never reaches into your cloud or SaaS.

Docs: developers.genesiscloud.com · Checked 2026-10-22 · source YAML · dispute via PR

Inbound F

How a workload running anywhere authenticates to this product.

Static API token (ID plus Secret Token) generated in the console's Keys and Tokens page and sent as Authorization: Bearer (X-Auth-Token is deprecated) to api.genesiscloud.com; the Terraform provider, Go client and Inference Service use the same kind of token, and Object Storage uses a static S3 access key and secret of the "Object Storage" token type.

developers.genesiscloud.com checked 2026-10-22
“Each request made to Genesis Cloud APIs must be authenticated.”
developers.genesiscloud.com checked 2026-10-22
“You can generate an API token by visiting the Keys and Tokens section of the dashboard.”
developers.genesiscloud.com checked 2026-10-22
“The X-Auth-Token authentication header is now deprecated.”
web.archive.org checked 2026-10-22
“API tokens are unique identifiers associated with your Genesis Cloud account and consist of an ID and a Secret Token.”
raw.githubusercontent.com checked 2026-10-22
“Set the `GENESISCLOUD_TOKEN` env var or specify the `token` in the provider”
web.archive.org checked 2026-10-22
“On the left sidebar "Keys & Tokens", you need to generate new Access key and a Secret token with an Object Storage type and copy them.”
developers.genesiscloud.com checked 2026-10-22
“Make sure to select Inference Service when creating a new token.”

One card: compute, object storage and inference share one console page of static secrets, so a split would not change any grade. No OIDC, GitHub Actions, workload identity or token exchange is documented on the developer site, the Terraform provider or Go client docs, or the support knowledge base, so every path a workload must use (control plane, Terraform, S3 data plane, inference) runs on a long-lived secret. The support site (support.genesiscloud.com) returned HTTP 403 to automated fetches and the OpenAPI spec at api.genesiscloud.com/compute/v1/openapi.yaml did not respond, so support articles are cited from Wayback Machine captures (latest available, 2025-03 to 2026-02). A Genesis-managed Kubernetes service or container registry, if one exists, is not documented publicly and was not graded.

Outbound n/a

How this product reaches into your cloud, repos, or other SaaS.

Genesis Cloud never needs access to customer infrastructure. Custom image import (POST /compute/v1/snapshots) only fetches a URL you supply, with no credential field.

developers.genesiscloud.com checked 2026-10-22
“To create a new snapshot from a custom image URL, send a request to:”
developers.genesiscloud.com checked 2026-10-22
“url String Required - The url pointing to a raw or raw with zstd compressed image.”
web.archive.org checked 2026-10-22
“In every case you will end up with a URL from which you can access your image, which is all you need to create a snapshot using our API.”

Checked: the Compute API reference (instances, images, snapshots, volumes, filesystems, floating IPs, SSH keys, security groups), the Object Storage and Inference Service API pages, the Terraform provider docs and the support knowledge base. No integration with a customer's AWS, GCP or Azure account, private container registry, Hugging Face or W&B is documented; instance startup scripts and metadata run inside your instance, not as Genesis reaching out. Image import is graded N/A, not keyless access: Genesis fetches a URL you supply with no credential, and the documented flow hosts the image in Genesis's own Object Storage. That is not access into your infrastructure. It differs from together-ai, where you sign a presigned URL into your own S3 bucket.

Hygiene for any static credential the product still issues

✗ Expiry enforceable	Neither the token article nor the API docs mention an expiry, a default lifetime or an org policy; manual revocation is the only documented end of a token's life. The console form is login-walled, so an expiry field there is not publicly verifiable and gets no credit. web.archive.org checked 2026-10-22 “The Secret Token is required to authenticate against our API and will only be displayed when you create the token.” developers.genesiscloud.com checked 2026-10-22 “If you accidentally publish your token, please immediately revoke it.”
✗ Rotation via API	The Compute API lists instances, images, snapshots, volumes, filesystems, SSH keys and security groups; the Go client generated from the OpenAPI spec has no token or access-key operations. Tokens and object storage keys are created and deleted only in the console. developers.genesiscloud.com checked 2026-10-22 “The Compute API allows you to manage your Compute Service resources:” web.archive.org checked 2026-10-22 “To generate a new token, click on 'Generate new API Token' in the 'API Tokens' section of the page.” raw.githubusercontent.com checked 2026-10-22
✗ Scoped keys	A token has a service type (Compute, Object Storage, Inference Service), but Genesis's own docs, including the Inference page, say a token "provides access to everything" in the account. Project roles (admin, editor, viewer) apply to human members; no service account, API-only principal or per-token role is documented. developers.genesiscloud.com checked 2026-10-22 “It is absolutely essential that you keep your secret token private as it provides access to everything in your Genesis Cloud account.” web.archive.org checked 2026-10-22 “If someone else sees your Token, they can gain full access to your resources.” web.archive.org checked 2026-10-22 “Members of a project can have one of three roles: admin, editor, or viewer.”
✗ Last-used visible	The token article describes the list as showing the ID and description; no last-used time is documented. The console itself is login-walled and not publicly verifiable. Even if expiry and last-used both turned out to pass in the console, inbound would stay F (2 of 5). web.archive.org checked 2026-10-22 “Only the ID and Description will show on your screen.”
✗ Leak revocation	Genesis Cloud does not appear in GitHub's supported secret-scanning patterns table, partner or otherwise. docs.github.com checked 2026-10-22

Notes

Graded on the public developer site, the Terraform provider and Go client repositories, and Wayback captures of the support knowledge base (the live support site blocks automated fetches). Every machine path runs on a full-account static token or S3 key with 0 of 5 hygiene checks passing. Cheapest fixes: a token create/revoke API, an enforced expiry, per-token roles or service accounts, a last-used column and a GitHub secret-scanning partnership (3 of these would make inbound D). Reaching B or A needs OIDC federation into api.genesiscloud.com and Object Storage.

Badge

[![wif.tax grade](https://wif.tax/badge/genesis-cloud.svg)](https://wif.tax/p/genesis-cloud/)