Voltage Park (Lightning AI)

F Voltage Park On-Demand control plane (cloud-api.voltagepark.com, VMs, bare metal, storage)

The On-Demand API that deploys VMs, bare metal, storage and Managed Kubernetes takes only a static bearer API token, issued through support or the dashboard. Tokens expire after one year, but no token API, scoping, last-used view or GitHub partner revocation is documented. Managed Kubernetes clusters are graded on the voltage-park-kubernetes card. Voltage Park never reaches into your cloud.

Low confidence. The dashboard Developers page where tokens are managed is behind a login. Scoping and last-used fail on public docs only; two more passes would make inbound D. Publishing the documentation is how a vendor gets credit.

Docs: support.voltagepark.com · Checked 2026-10-22 · source YAML · dispute via PR

Inbound F

How a workload running anywhere authenticates to this product.

Static API token sent as Authorization: Bearer to cloud-api.voltagepark.com (the OpenAPI spec also lists a UI-Authorization header used by the web console). Tokens are requested from support or created on the dashboard Developers page. No OIDC, workload identity or token-exchange path exists for the control plane.

support.voltagepark.com checked 2026-10-22
“This API uses Bearer Token Authentication to authorize requests.”
support.voltagepark.com checked 2026-10-22
“Every request must include a valid API token in the Authorization header.”
support.voltagepark.com checked 2026-10-22
“Since self-service API key generation is currently not available, API keys must be requested from our support team.”
support.voltagepark.com checked 2026-10-22
“Our Voltage Park On Demand API allows developers to deploy, manage, and monitor virtual machines (VMs) and bare metal instances.”
cloud-api.voltagepark.com checked 2026-10-22
“API authorization generated from TensorDock storefront”
cloud-api.voltagepark.com checked 2026-10-22
“"description":"UI Authorization Header","in":"header","name":"UI-Authorization"”

Graded on the On-Demand API, the only documented way for a workload to deploy, resize or terminate VMs, bare metal, storage and Kubernetes clusters. Every operation in the OpenAPI spec accepts the bearer token (apiTokenAuth) or the console's UI-Authorization header, and nothing else; the spec describes the token as generated from the TensorDock storefront the API is built on. No Terraform provider, CLI, OIDC, GitHub Actions or cloud workload identity path is documented. The API page contradicts itself on issuance (support-only, yet "create new tokens or delete existing ones" on the Developers page); either way it is a human in a browser or a support ticket. The Managed Kubernetes cluster API server, which can trust your own OIDC issuer, is graded separately on the voltage-park-kubernetes card (the split follows coreweave-api and coreweave-cks); creating or changing a cluster is still a call to this API with this token. Storage is VAST NFS mounted by IP allowlist, with no access keys. SSH access to instances uses your public keys.

Outbound n/a

How this product reaches into your cloud, repos, or other SaaS.

Voltage Park never needs access into customer infrastructure: no bucket import, registry pull, model hub or data sync integration exists.

cloud-api.voltagepark.com checked 2026-10-22
“The all-purpose management API for Voltage Park On-Demand.”
support.voltagepark.com checked 2026-10-22
“Backed by VAST Data’s Universal Storage architecture, our storage offering delivers all-flash performance and exabyte-scale capacity to meet the demands of modern AI, ML, HPC, and data-intensive applications.”
support.voltagepark.com checked 2026-10-22
“Now, we download the model from Huggingface through the Ollama command-line interface:”

Checked the full OpenAPI spec (virtual machines, bare metal, Kubernetes, billing, organization, SSH keys, cloud-init validation, locations, storage) and every help-center article: none stores a customer cloud, registry, Hugging Face or W&B credential or pulls data on the customer's behalf. Storage is Voltage Park-hosted VAST NFS; the shared-storage API only allowlists client IPs. Model and data downloads in the tutorials are run by the customer's own code on the rented machine, which is not the product reaching in.

Hygiene for any static credential the product still issues

✓ Expiry enforceable	The docs state a fixed one-year lifetime with no "never" option, a platform-enforced maximum (the precedent on temporal, where a 2-year cap passes). Whether a shorter lifetime can be chosen or enforced by org policy is not publicly verifiable. support.voltagepark.com checked 2026-10-22 “Tokens are valid for one year, after which they expire, so be sure to rotate them regularly to maintain access.”
✗ Rotation via API	Tokens are created and deleted on the dashboard or by support. The OpenAPI spec has no endpoint to create, list or revoke API tokens; the only credential endpoints manage organization SSH public keys. Rotation needs a browser. support.voltagepark.com checked 2026-10-22 “On the Developers page of the Voltage Park dashboard, you can view and manage your API tokens.” cloud-api.voltagepark.com checked 2026-10-22 “Add new SSH public key to your organization”
✗ Scoped keys	No token permissions, scopes, roles or service-account type are documented; organization management is a member list and an invite button. One token reaches every operation in the spec, including billing and organization settings. Not publicly verifiable whether the login-walled Developers page offers scopes. support.voltagepark.com checked 2026-10-22 “Keep your API key secure! Treat it like a password and NEVER expose it in public repositories.” support.voltagepark.com checked 2026-10-22 “Send Invite: Click this button to invite teammates to join the platform.”
✗ Last-used visible	The only description of the Developers page mentions create and delete. No last-used timestamp is documented; not publicly verifiable beyond that. support.voltagepark.com checked 2026-10-22 “From this page, you can create new tokens or delete existing ones.”
✗ Leak revocation	Neither Voltage Park, Lightning AI nor TensorDock appears in GitHub's supported secret-scanning patterns table, so a leaked API token is not reported to Voltage Park. docs.github.com checked 2026-10-22

Notes

Voltage Park merged into Lightning AI in January 2026 and its help center is now run by Lightning AI; this card grades the Voltage Park On-Demand control plane (VMs, bare metal, storage), and voltage-park-kubernetes grades the Managed Kubernetes cluster API. Dedicated Reserve contracts use the same platform and no separate machine auth is documented. Lightning AI's own Studio platform is a separate product, not graded here. One of five hygiene checks passes (expiry), so inbound is F; an API to mint and revoke tokens plus scoped tokens or a service-account type would lift it to D. Inbound moves to B or A only if cloud-api.voltagepark.com accepts a federated token, which the Kubernetes add-on shows the team already knows how to wire up.

Badge

[![wif.tax grade](https://wif.tax/badge/voltage-park.svg)](https://wif.tax/p/voltage-park/)