The static key tax.

Some products let your workloads authenticate with a short-lived federated identity. The rest make you hold a long-lived secret, and you pay for that in rotation toil, vault sprawl, and eventually an incident.

This is the list. Machines only. Every grade has a receipt.

13products

6keyless (A)

3static only (D–F)

2026-09-17last build

Grade	Product	Inbound	Outbound	Hygiene	Checked
F	CoreWeave Control-plane API (api.coreweave.com, Terraform provider, kubeconfigs)	F	n/a	✓✗✗✗✗	2026-09-17
D	Cloudflare API / API tokens	D	B	✗✓✓✓✓	2026-09-16
D	Twilio REST API	C	D	✗✓✓✗✓	2026-09-16
C	Anthropic Claude API	A	C	✓✗✓✗✓	2026-09-17
C	GitHub REST/GraphQL API and Actions	C	A	✓✗✓✓✓	2026-09-16
B	Datadog API (API keys + application keys)	B	B	✗✓✓✓✓	2026-09-16
B	HashiCorp Vault (self-managed and HCP Vault Dedicated)	A	B	✓✓✓✗✗	2026-09-16
A	Amazon Web Services IAM / STS	A	A	✗✓✓✓✓	2026-09-16
A	CoreWeave AI Object Storage	A	n/a	✗✓✗✗✗	2026-09-16
A	CoreWeave CKS (Kubernetes Service)	A	A	✓✗✗✗✗	2026-09-16
A	Google Cloud IAM / Workload Identity Federation	A	A	✓✓✓✓✓	2026-09-16
A	Microsoft Azure Entra ID workload identities	A	A	✓✓✓✓✓	2026-09-16
A	Snowflake Data Cloud	A	A	✓✓✓✓✓	2026-09-16

Headline grade is the lower of the two surfaces. Hygiene marks: expiry · rotation API · scoping · last-used · leak revocation. Read the rubric. Grades as JSON: /api/products.json.