Skip to main content
This page helps you connect to CoreWeave AI Object Storage by selecting an authentication method, configuring an S3-compatible client, and starting to work with objects in your buckets. It’s for developers and operators who prepare applications or tools to interact with Object Storage.

​
Authentication methods

Object Storage supports several authentication methods. Choose the method that best fits your use case, then continue to Configure your client. For production workloads, Workload Identity Federation with OIDC provides a secure authentication method. Your applications obtain tokens from your identity provider and exchange them for temporary CoreWeave access credentials that automatically expire. In Kubernetes environments, the Container Credentials API enables automatic credential rotation without application changes. For setup details, see Configure AWS CLI and boto3.

​
Direct access token exchange

If you already authenticate with a CoreWeave API access token, you can exchange it directly for temporary credentials using the Container Credentials API, without creating a separate static Access Key. The temporary credentials also carry the principal’s SCIM group memberships for group-based and attribute-based access control. For setup details, see Direct access token exchange.

​
Credential process

The CoreWeave Intelligent CLI provides ready-made credential process commands, so you don’t need to write and maintain your own script. AWS SDKs run the command named in your AWS config to fetch and refresh credentials. The CLI commands cache the exchanged keys, so parallel processes that use the same profile share one credential instead of each performing their own exchange. This works for interactive sign-in and for machine workloads. See Share credentials across processes. If those commands don’t cover your token exchange, you can still point credential_process at a custom script. For that pattern, see Configure AWS CLI and boto3.

​
Static credentials

For initial testing and development, you can use static Access Keys created through the Cloud Console. Static credentials are long-lived and require manual rotation, so they aren’t recommended for production use.
Static Access Keys are a security risk in production environments because they are long-lived and can be leaked. Use Workload Identity Federation instead.

​
Configure your client

After choosing an authentication method, configure your S3-compatible client:

​
Work with objects

With authentication set up and your client configured, you’re ready to interact with your data. You can manage objects in your buckets, including uploads, listings, deletions, and renames. For endpoint configuration details, including virtual-hosted addressing and LOTA endpoints, see Set endpoints.
Last modified on August 25, 2026