> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coreweave.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managed Authentication in CKS

> Understand Managed Auth kubeconfig files for CKS clusters and resolve common authentication errors

Use this page to understand the kubeconfig files that Managed Auth generates for CoreWeave Kubernetes Service (CKS) clusters, including the fields in a generated file and common authentication errors.

To create an API access token and download a kubeconfig file, see [Manage API access tokens and kubeconfig files](/security/authn-authz/manage-api-access-tokens). For an overview of Managed Auth across CoreWeave, see [Managed Auth](/security/authn-authz/managed-auth/introduction).

## Generated kubeconfig structure

Managed Auth generates kubeconfig files for your CKS clusters from the Cloud Console. These files follow the permissions configured for their related tokens and embed the API access token.

The following example shows a kubeconfig file generated by Managed Auth:

```yaml theme={"system"}
apiVersion: v1
clusters:
- cluster:
    server: https://api-server.url.com
  name: my-cluster
contexts:
- context:
    cluster: my-cluster
    namespace: my-namespace
    user: token
  name: my-cluster
current-context: my-cluster
kind: Config
preferences: {}
users:
- name: token
  user:
    token: REDACTED
```

Generated kubeconfig files contain the following values and might include additional values:

| Field | Description |
| - | - |
| `apiVersion` | The [API group](https://kubernetes.io/docs/reference/using-api/#api-groups) version. |
| `clusters` | Connection settings for the target cluster, including the API server URL. |
| `clusters.cluster.server` | The API server URL. |
| `clusters.cluster.name` | The cluster name. |
| `contexts` | The [Kubernetes context](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/#context_) containing the related cluster, user, and namespace name. |
| `contexts.context.cluster` | The cluster associated with the context. |
| `contexts.context.namespace` | The namespace associated with the context. |
| `contexts.context.user` | The user associated with the context, in this case an API access token (`token`). |
| `users` | A list of users associated with the context, in this case the API access token (`token`). |
| `users.name` | The name of the user, in this case the API access token, `token`. |
| `users.user.token` | The API access token value. |

## Authentication errors

The following errors can occur when you use a Managed Auth kubeconfig file. For help choosing an authentication method, see [Introduction to authentication and access control](/products/cks/auth-access/introduction).

| Error or symptom | What it means and how to resolve it |
| - | - |
| `403 Forbidden` on every request, often with an empty response body and messages such as `couldn't get current server API group list` or `Error from server (Forbidden)` | The API access token is missing, malformed, expired, or revoked. Tokens have an expiration date, so a token that worked previously can expire between sessions. Reissue the token and download a new kubeconfig file from the [Access Tokens dashboard](https://console.coreweave.com/tokens) in the Cloud Console. See [Manage API access tokens and kubeconfig files](/security/authn-authz/manage-api-access-tokens). |
| `403 Forbidden` on specific actions | The token is valid, but it lacks the permissions for the action. API access tokens are user-scoped and inherit the token owner's IAM roles. Review the owner's assigned roles in [IAM Access Policies](/security/iam/access-policies). The [Access Tokens dashboard](https://console.coreweave.com/tokens) only lists and deletes tokens, so it doesn't show or configure permissions. |
| The `certificate-authority-data` field is present on a new cluster | The managed endpoint uses a publicly trusted certificate, so the `certificate-authority-data` field is unnecessary and can cause connection errors. Don't set this field in a Managed Auth kubeconfig file for a new cluster. Use the kubeconfig file generated by the Cloud Console without changes. Clients that connect through a TLS-passthrough path, such as the [Traefik API proxy](/products/cks/clusters/coreweave-charts/traefik#ingressroutetcp-and-kubernetes-api-proxy) or the Tailscale proxy in [Direct Auth](/products/cks/auth-access/tailscale-vpn#direct-auth) mode, reach the API server directly. Those clients must trust the cluster certificate authority (CA) and authenticate with a Kubernetes-native credential, such as an OIDC token, because the API server rejects API access tokens. |

<Note>
  The managed endpoint returns `403 Forbidden` for token problems, not `401 Unauthorized`. A `401` on a CKS cluster points to an OIDC or unmanaged authentication issue instead. If several users share one token, its expiration or revocation blocks all of them at once. Give each user their own token.
</Note>