CoreWeave
F Control-plane API (api.coreweave.com, Terraform provider, kubeconfigs)
This card is the control plane only: the API that creates CKS clusters and VPCs, the Terraform provider, and managed-auth kubeconfigs. Its one credential is a static, user-scoped API Access Token minted by hand in the Cloud Console, with almost no hygiene around it. CoreWeave's CKS and AI Object Storage cards grade very differently; see those.
Docs: docs.coreweave.com · Checked 2026-09-17 · source YAML · dispute via PR
Inbound F
How a workload running anywhere authenticates to this product.
A static, user-scoped API Access Token created in the Cloud Console (CW-SECRET-... via COREWEAVE_API_TOKEN for Terraform); no federation path exists into api.coreweave.com.
- docs.coreweave.com checked 2026-09-16
“API Access Tokens are user-scoped tokens that grant users permission to access API endpoints. They gate the ability to deploy CKS Clusters, VPCs, and to manage and access cluster metrics.”
- docs.coreweave.com checked 2026-09-17
“This page explains how to create, use, and manage API Access Tokens and the kubeconfig files generated alongside them, so you can authenticate kubectl to CKS clusters and keep credentials secure.”
- docs.coreweave.com checked 2026-09-16
“Managed auth uses CoreWeave-issued API access tokens against the managed-auth endpoint”
- docs.coreweave.com checked 2026-09-16
Nothing in the token docs, the CKS API reference, or the Object Storage WIF docs describes exchanging an external OIDC/SAML token for a control-plane token; Object Storage's WIF explicitly "only generates temporary credentials" for Object Storage. So the Terraform provider and every cluster/VPC create call run on a long-lived Console token, and 1 of 5 hygiene checks passes. The CKS clusters this API creates, and AI Object Storage, both accept federated identities and are graded on their own cards.
Outbound n/a
How this product reaches into your cloud, repos, or other SaaS.
The control plane never needs access to customer infrastructure.
- docs.coreweave.com checked 2026-09-16
The CKS API exposes only cluster list/create/get/delete/update; no integration pulls from a customer cloud. Per-cluster OIDC issuance is graded on the CKS card.
Hygiene for any static credential the product still issues
| ✓ Expiry enforceable | Every API Access Token carries an expiration set at creation. The docs do not state the default, the maximum, whether "never" is selectable, or whether an org policy can cap it; passed on the documented statement that tokens have an expiration date.
|
| ✗ Rotation via API | Tokens are created and deleted only in the Cloud Console; the CKS API has no token endpoints. Rotation means a human in a browser.
|
| ✗ Scoped keys | A token is the user; there is no way to restrict one to a cluster, a namespace, or a subset of the user's org permissions.
|
| ✗ Last-used visible | No last-used timestamp is documented for API Access Tokens in the token management or support pages. Graded conservatively.
|
| ✗ Leak revocation | CoreWeave does not appear anywhere in GitHub's supported secret-scanning patterns list, partner or otherwise, despite tokens having a greppable CW-SECRET- prefix.
|
Notes
Home team, graded on the same rubric as everyone else. The fix is a federated path into api.coreweave.com (exchange an OIDC token for a short-lived control-plane token, the way Object Storage already does), then an API to mint and revoke tokens, token scoping, a last-used column, and a GitHub secret-scanning partnership.
Badge
[](https://wif.tax/p/coreweave-api/)