wif.tax

Together AI

F Together AI platform (inference, fine-tuning, GPU clusters API)

Every workload path into Together (inference, fine-tuning, the GPU cluster API, the CLI in CI, the container registry) runs on a static project API key. There is no OIDC or federation path for workloads. Keys are project-scoped, but expiry is optional, there is no API to mint or revoke them, no last-used view and no GitHub partner revocation. Pulls from S3 use presigned URLs; Hugging Face and W&B want pasted tokens.

Docs: docs.together.ai · Checked 2026-10-22 · source YAML · dispute via PR

Inbound F

How a workload running anywhere authenticates to this product.

Static project-scoped API key (Authorization: Bearer, TOGETHER_API_KEY) created in the web console, used by the REST API, SDKs, the tg CLI in CI and image pushes to Together's registry. The CLI's browser device login is for humans; GPU cluster OIDC is interactive kubectl login for team members.

Graded on the weakest path a workload must use: every control-plane call (create a cluster, launch a fine-tune, deploy an endpoint) and every inference call takes a project API key, and Together's own GitHub Actions example stores one as a repo secret. The OpenAPI spec defines only a bearerAuth scheme; no token exchange, GitHub Actions OIDC, cloud workload identity or service-account type is documented, and no Terraform provider is listed in the public registry. GPU cluster "external OIDC" makes the cluster's Kubernetes API server trust an issuer and client ID you set at cluster creation (it cannot be added later), so a JWT from your IdP authenticates kubectl and RBAC binds on email, preferred_username or sub. It is documented only as an interactive browser/PKCE login for team members, and creating the cluster and fetching its kubeconfig still need the API key or console, so it does not lift the grade (rubric: federation must be self-serve and documented for workloads). A Kubernetes-native workload identity setup on that API server may work but is not documented. Not split into a GPU clusters card: unlike CoreWeave CKS, the cluster control plane uses the same API key and the only federation is the human kubectl login described here.

Outbound B

How this product reaches into your cloud, repos, or other SaaS.

Model and adapter imports from S3 take a presigned archive URL you mint (no credential handed over). Hugging Face imports and pushes take a pasted hf_ token, and W&B logging takes a pasted W&B API key.

Checked: dedicated-endpoint model and LoRA adapter uploads (Hugging Face, S3), the remote model upload API, fine-tuning from a Hugging Face model (from_hf_model, hf_api_token), fine-tuning output to Hugging Face (hf_output_repo_name), Weights & Biases logging (wandb_api_key), the console Vercel integration, dedicated containers (images come from Together's own registry, secrets are values you store with Together) and GPU clusters (data loads are pods you run, not Together reaching in). Judgment call: S3 is counted as keyless because Together never holds an AWS credential, only a presigned URL you sign yourself with a minimum 100-minute life; there is no cross-account IAM role, GCS or Azure path at all. Hugging Face and W&B take static tokens, with only a "read access" hint and no rotation guidance, which caps outbound at B. The Vercel integration is a console connection that pushes a Together key into Vercel (consent, no secret given to Together). Outbound would be A with Hugging Face OAuth/app consent and a W&B alternative to pasted keys; if presigned URLs are not accepted as keyless, this is D/F.

Hygiene for any static credential the product still issues

✗ Expiry enforceable
Expiry is opt-in at creation, can be cancelled afterwards, and the docs recommend it only "for keys used in temporary or testing contexts". No org policy can force it. A changeable default is not an enforced expiry (precedent: temporal passes on a platform-enforced cap).
  • docs.together.ai checked 2026-10-22
    “To make the key expire automatically, select **Set an expiration date** and choose a preset or custom date.”
  • docs.together.ai checked 2026-10-22
    “To keep a key that's scheduled to expire, select **Cancel expiration** from the same menu.”
✗ Rotation via API
Keys are created, given an expiry and revoked in the console only. The public OpenAPI spec has no API-key endpoints (projects are list-only), and the CLI has no key commands.
✓ Scoped keys
Passed narrowly: a project key belongs to the project, not to a person, and reaches only that project's resources, so a dedicated project per workload gives a resource-limited credential. There are no per-key permissions (a key is full access to its project, RBAC for inference and fine-tuning is "still being rolled out") and the legacy org key "can't be scoped to a specific project or workload, and can't be revoked". If resource-only scoping is not enough, this flips to fail and the grade is unchanged.
  • docs.together.ai checked 2026-10-22
    “A key created in project A can only access resources in project A.”
  • docs.together.ai checked 2026-10-22
    “Keys persist even if the collaborator who created them is removed from the project.”
  • docs.together.ai checked 2026-10-22
    “Anyone holding a key has full access to its project's resources and can spend your credit balance, which auto-recharge tops back up.”
  • docs.together.ai checked 2026-10-22
    “Today, all project collaborators (both admins and editors) have full access to these services.”
✗ Last-used visible
No last-used timestamp is documented for API keys. Cost analytics can group daily spend by key (beta), which shows billable usage only, not a last-use time. The API keys settings page itself is behind a login and not publicly verifiable; even if it shows a last-used column, that is two of five checks and inbound stays F.
  • docs.together.ai checked 2026-10-22
    “The cost analytics dashboard charts your daily spend or billable units, such as tokens, so you can see which products, projects, and API keys drive your usage over time.”
  • docs.together.ai checked 2026-10-22
    “Use API key IDs to segment usage and cost by key and workload.”
✗ Leak revocation
Together AI does not appear in GitHub's supported secret-scanning patterns table, partner or otherwise. A leaked key keeps working until someone revokes it in the console.

Notes

One card for the Together platform: serverless and dedicated inference, fine-tuning and post-training, dedicated containers and the GPU clusters API all share one credential, the project API key. One of five hygiene checks passes (scoping, narrowly). Inbound moves to D with an API to create and revoke keys plus enforced expiry or a last-used column, and to B or A only with a documented token exchange for workloads (GitHub Actions OIDC, cloud workload identity or a bring-your-own issuer). GPU cluster Kubernetes OIDC already trusts customer issuers for humans; documenting it for workloads would help the data plane but not the API-key control plane.

Badge

wif.tax grade F

[![wif.tax grade](https://wif.tax/badge/together-ai.svg)](https://wif.tax/p/together-ai/)