About authentication and access control
Authentication and authorization for CoreWeave AI Object Storage
Before you start using CoreWeave AI Object Storage, you must set up access tokens, access keys, and organization access policies. Bucket access policies are optional. You can use them for finer-grained control of your resources. The Object Storage API lets you manage access keys and policies programmatically, while the Object Storage S3 endpoint lets you create and manage buckets and objects.
For production workloads, CoreWeave recommends Workload Identity Federation as the method for obtaining Access Keys. It exchanges short-lived OIDC tokens for temporary credentials, which eliminates the need to store or rotate long-lived static keys.
If a principal already authenticates with a CoreWeave API access token, CoreWeave recommends exchanging that token directly for temporary credentials instead of creating a separate static Access Key. This method also carries the principal’s SCIM group memberships, which you can use for group-based and attribute-based access control. See Direct access token exchange.
The following diagram outlines how to choose an authentication and management approach for Object Storage:
Last modified on July 10, 2026