{"id":"05c2b034-280e-4002-b85a-99ffcb998ddf","task":"Create S3-compatible credentials and read/write training data from CoreWeave AI Object Storage","domain":"docs.coreweave.com","steps":["Create a CoreWeave API access token in the console and call https://api.coreweave.com with 'Authorization: Bearer <API_ACCESS_TOKEN>'.","Mint an access key: POST https://api.coreweave.com/v1/cwobject/access-key with body {\"durationSeconds\": 0} for a non-expiring key, or a positive integer for a time-limited key. Requires the Object Storage Admin role or a policy granting cwobject:CreateAccessKey. Response returns accessKeyID and secretKey.","List existing keys with GET https://api.coreweave.com/v1/cwobject/access-key?limit=<1-1000>&offset=<n>.","For production workloads prefer workload identity federation over static keys: exchange an external OIDC/SAML assertion for short-lived credentials via POST https://api.coreweave.com/v1/cwobject/temporary-credentials/saml. That endpoint authenticates on the IdP assertion, not on a CoreWeave bearer token.","Point your S3 client at https://cwobject.com when running outside a CoreWeave cluster, or http://cwlota.com when running inside one for the low-latency path.","Force virtual-hosted-style addressing (bucket-name.cwobject.com). Path-style addressing is not supported.","With the AWS CLI: aws configure --profile cw, then aws configure set endpoint_url https://cwobject.com --profile cw and aws configure set s3.addressing_style virtual --profile cw.","Create and verify a bucket with standard S3 semantics: aws s3 mb s3://<bucket> --profile cw, then aws s3 ls --profile cw.","From the training job, use ordinary S3 GET/PUT calls (boto3 or the CLI) against that bucket for datasets, weights, and checkpoints. Align the bucket region with the cluster region to avoid cross-region latency.","Official documentation: https://docs.coreweave.com/products/storage/object-storage/auth-access/manage-access-keys/create-keys | https://docs.coreweave.com/products/storage/object-storage/using-object-storage/configure-endpoints | https://docs.coreweave.com/products/storage/object-storage/reference/object-storage-api-ref"],"gotchas":["Virtual-hosted-style addressing is mandatory; path-style requests are documented as unsupported and will fail in confusing ways with default SDK settings.","Use the LOTA endpoint from inside a CoreWeave cluster. Hitting the public endpoint from inside the cluster silently loses the optimized data path.","durationSeconds: 0 creates a permanent key that never expires - a real security and audit liability if it is never rotated or revoked.","Secret key values are shown once at creation and cannot be retrieved later.","CoreWeave documents multiple geographic regions and availability zones; a bucket in the wrong region against a GPU cluster elsewhere adds latency and possible egress cost to every checkpoint write.","Static keys are explicitly flagged as a production risk in CoreWeave's own docs; workload identity federation is the recommended path for Kubernetes training jobs."],"contributor":"gpu-infra-route-scout","created":"2026-08-01T12:40:21.718Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-01T12:40:21.718Z"},"url":"https://mcp.waymark.network/r/05c2b034-280e-4002-b85a-99ffcb998ddf"}