Create a CoreWeave AI Object Storage access key for a container workload

Create access key from container credentials

curl --request GET \
  --url https://api.coreweave.com/v1/cwobject/temporary-credentials/oidc/{orgId} \
  --header 'Authorization: <api-key>'

import requests

url = "https://api.coreweave.com/v1/cwobject/temporary-credentials/oidc/{orgId}"

headers = {"Authorization": "<api-key>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: '<api-key>'}};

fetch('https://api.coreweave.com/v1/cwobject/temporary-credentials/oidc/{orgId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.coreweave.com/v1/cwobject/temporary-credentials/oidc/{orgId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.coreweave.com/v1/cwobject/temporary-credentials/oidc/{orgId}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.coreweave.com/v1/cwobject/temporary-credentials/oidc/{orgId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "AccessKeyId": "<string>",
  "SecretAccessKey": "<string>",
  "Token": "<string>",
  "Expiration": "2023-11-07T05:31:56Z",
  "attributes": {},
  "multiAttributes": {}
}

{
  "code": 123,
  "message": "<string>",
  "details": [
    {
      "@type": "<string>"
    }
  ]
}

GET

cwobject

temporary-credentials

oidc

{orgId}

Create access key from container credentials

curl --request GET \
  --url https://api.coreweave.com/v1/cwobject/temporary-credentials/oidc/{orgId} \
  --header 'Authorization: <api-key>'

import requests

url = "https://api.coreweave.com/v1/cwobject/temporary-credentials/oidc/{orgId}"

headers = {"Authorization": "<api-key>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: '<api-key>'}};

fetch('https://api.coreweave.com/v1/cwobject/temporary-credentials/oidc/{orgId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.coreweave.com/v1/cwobject/temporary-credentials/oidc/{orgId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.coreweave.com/v1/cwobject/temporary-credentials/oidc/{orgId}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.coreweave.com/v1/cwobject/temporary-credentials/oidc/{orgId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "AccessKeyId": "<string>",
  "SecretAccessKey": "<string>",
  "Token": "<string>",
  "Expiration": "2023-11-07T05:31:56Z",
  "attributes": {},
  "multiAttributes": {}
}

{
  "code": 123,
  "message": "<string>",
  "details": [
    {
      "@type": "<string>"
    }
  ]
}

gRPC method: `CreateAccessKeyFromContainerCreds`

The API server is https://api.coreweave.com.
This endpoint uses the ContainerCredentialsAuth scheme: send a raw JWT/OIDC token as the Authorization header value, with no Bearer prefix. This shape matches the AWS container-credentials provider for in-cluster workloads.

Returns a short-lived CoreWeave AI Object Storage access key for an in-cluster workload, authenticated by the workload’s own OIDC token. The response uses the AWS-compatible PascalCase shape (AccessKeyId, SecretAccessKey, Token, Expiration) so existing AWS SDKs and tooling that consume the AWS_CONTAINER_CREDENTIALS_FULL_URI environment variable can adopt it without code changes. Substitute {orgId} with your organization ID.

Example request

curl -X GET https://api.coreweave.com/v1/cwobject/temporary-credentials/oidc/{orgId} \
       -H "Content-Type: application/json" \
       -H "Authorization: [OIDC-TOKEN]"

Authorizations

Authorization

string

header

required

Raw JWT/OIDC token sent as the Authorization header value with no Bearer prefix. Only used by GET /v1/cwobject/temporary-credentials/oidc/{orgId} for the AWS-style container-credentials provider.

Path Parameters

orgId

string

required

Response

AWS-compatible container-credentials response shape. The property names use PascalCase (AccessKeyId, SecretAccessKey, Token, Expiration) so existing AWS SDKs and tooling that consume AWS_CONTAINER_CREDENTIALS_FULL_URI can adopt this endpoint without code changes. This is intentional and differs from every other endpoint, which uses camelCase.

AccessKeyId

string

The access-key ID.

SecretAccessKey

string

The secret access key. Treat as a credential.

Token

string

An optional session token. May be empty for non-session credentials.

Expiration

string<date-time>

The expiration time of the credentials.

attributes

object

Free-form caller-supplied attributes attached to the key (for example, name).

Show child attributes

multiAttributes

object

Free-form caller-supplied multi-valued attributes attached to the key. Each value is an AttributeList (an array of strings).

Show child attributes

Authentication and Access Control

Use Object Storage

Improve Performance

Reference

Create access key from container credentials

gRPC method: `CreateAccessKeyFromContainerCreds`

Authorizations

Path Parameters

Response

gRPC method: CreateAccessKeyFromContainerCreds

Authorizations

Path Parameters

Response

gRPC method: `CreateAccessKeyFromContainerCreds`