CoreWeave
A AI Object Storage
This card is object storage only. Any OIDC issuer with a discovery document can be exchanged for 30-minute S3-compatible keys (SAML gets up to 12 hours), and CoreWeave recommends exactly that for production. The permanent access keys that still exist have poor hygiene, and creating them requires the static control-plane token graded F on the coreweave-api card.
Docs: docs.coreweave.com · Checked 2026-09-16 · source YAML · dispute via PR
Inbound A
How a workload running anywhere authenticates to this product.
Workload Identity Federation: POST a JWT from any OIDC provider that implements OIDC Discovery (issuer URL configured per org) to api.coreweave.com/v1/cwobject/temporary-credentials/oidc/[ORG-ID] and receive a 30-minute AccessKeyId/SecretAccessKey; SAML assertions yield keys up to 12h.
- Issuers
- any
- docs.coreweave.com checked 2026-09-16
“Exchange OIDC tokens for temporary AI Object Storage credentials using Workload Identity Federation”
- docs.coreweave.com checked 2026-09-16
“Issuer URL: Your OIDC provider's identifier URL, such as https://your-domain.okta.com or https://accounts.google.com.”
- docs.coreweave.com checked 2026-09-16
“It exchanges short-lived OIDC tokens for temporary credentials, which eliminates the need to store or rotate long-lived static keys.”
- docs.coreweave.com checked 2026-09-16
“30-minute lifespan, automatically refreshed”
- docs.coreweave.com checked 2026-09-16
“up to a maximum of 12 hours”
- docs.coreweave.com checked 2026-09-16
“Works with existing identity providers including AWS IAM, GCP Workload Identity, Azure Managed Identities, and custom OIDC providers.”
Documented tutorials cover GitHub Actions and non-CKS Kubernetes clusters; the provider must implement OIDC Discovery and standard claims. WIF only mints credentials; org and bucket access policies (which can reference OIDC group claims) still have to be written separately. Shipped 2025-11-20. A direct exchange of a control-plane API token for 30-minute keys also exists, but that is a static root and would be C on its own.
Outbound n/a
How this product reaches into your cloud, repos, or other SaaS.
Object storage never needs access to customer infrastructure.
- docs.coreweave.com checked 2026-09-16
Hygiene for any static credential the product still issues
| ✗ Expiry enforceable | Static keys created via CreateAccessKeyFromJWT take durationSeconds; 0 means permanent, otherwise up to 12 hours. No documented default and no org policy to forbid permanent keys, so the "cannot be forced" clause of the rubric applies. Graded conservatively.
|
| ✓ Rotation via API | Keys can be created and revoked through the Object Storage API, but the create call itself authenticates with the static control-plane API Access Token.
|
| ✗ Scoped keys | Access is governed by organization and bucket policies attached to the principal, not to the key; nothing documented lets one key carry fewer permissions than its owner. The quoted policy governs who may create keys, not what a key may do. Graded conservatively.
|
| ✗ Last-used visible | No last-used field is documented on access keys. Audit logging exists for object operations but was not assessed as a per-key last-used signal.
|
| ✗ Leak revocation | CoreWeave is not on GitHub's secret-scanning list.
|
Notes
Home team, graded on the same rubric as everyone else. The A is real and the docs push production users toward it; the remaining tax is that permanent keys are still one API call away, and that call runs on the control-plane token.
Badge
[](https://wif.tax/p/coreweave-object-storage/)