Skip to main content
Before you start using CoreWeave AI Object Storage, you must set up access tokens, access keys, and organization access policies. Bucket access policies are optional. You can use them for finer-grained control of your resources. The Object Storage API lets you manage access keys and policies programmatically, while the Object Storage S3 endpoint lets you create and manage buckets and objects. For production workloads, CoreWeave recommends Workload Identity Federation as the method for obtaining Access Keys. It exchanges short-lived OIDC tokens for temporary credentials, which eliminates the need to store or rotate long-lived static keys. If a principal already authenticates with a CoreWeave API access token, CoreWeave recommends exchanging that token directly for temporary credentials instead of creating a separate static Access Key. This method also carries the principal’s SCIM group memberships, which you can use for group-based and attribute-based access control. See Direct access token exchange. The following diagram outlines how to choose an authentication and management approach for Object Storage:

​
Authentication summary table

This table summarizes the authentication required to use each Object Storage API and interface:
API/InterfacePurposeAuthentication required
Object Storage API
api.coreweave.com		Object Storage control plane
Create access keys, org policies		API Access Token for a principal that has the Object Storage Admin IAM role (through IAM Access Policies). For Object Storage, this IAM role replaces the legacy CoreWeave admin group.
Object Storage S3-compatible endpoints
cwobject.com or cwlota.com		Storage operations
Manage buckets, upload objects		Access Keys: obtained directly from a CoreWeave API access token for temporary credentials, by creating a static key with an API access token, or through Workload Identity Federation (recommended for production)
Cloud ConsoleBoth IAM and StorageAPI Access Tokens for Console/API actions
Access Keys for S3-compatible bucket and object operations
Last modified on June 29, 2026