CoreWeave

To integrate with CoreWeave AI Object Storage:

Create a bucket in CoreWeave to store your files.
Create an access key for Encord to use.
Create an organization access policy that gives the access key the necessary access to your bucket. No bucket policy is needed.
Activate Cross-origin resource sharing to allow Encord to access your files from a web browser.
Create the integration in Encord.
Test the integration to ensure it works.

A new CoreWeave organization has no S3 API access until an organization access policy exists for your user’s principal (coreweave/<user-UID>). If requests to your bucket are denied, create that policy first.
CoreWeave AI Object Storage only accepts virtual-hosted URLs: https://<bucket-name>.cwobject.com/<path>. See Register CoreWeave Data.

1. Create a Bucket in CoreWeave

Log in to the CoreWeave Console.
Open the app menu (the grid icon at the top left) and select Infra Control.

Click Data and storage in the sidebar.
In the Object storage tab, click Create bucket.
Enter a unique Name for the bucket.
Select a region (for example, US-East) and a Zone (for example, US-EAST-04A).
Click Create to finalize the bucket.

You need the bucket URL and zone, but they can be accessed later: the Object storage tab lists each bucket with its Links and Zone. Use the https://<bucket-name>.cwobject.com link.

2. Create an Access Key in CoreWeave

Open the app menu (the grid icon at the top left) and select Access Control.
Click Object storage access keys in the sidebar.

Click Create key.
Enter a Name and select a Duration for the key.

The Duration defaults to 12 hours (the options are 1 hour, 12 hours, 1 day, 7 days, 30 days, and Permanent). Encord can no longer access your bucket once the key expires, so select a duration that covers how long you use the integration, and update the integration with a new key before it expires.

Click Create, then copy the Key ID and Key secret from the Access key created dialog. They are required for your integration with Encord.

Store the Key secret securely, as CoreWeave does not display it again after you close the dialog.

A CoreWeave access key acts with the permissions of the user or principal that created it. To give Encord read-only access, create the key under a dedicated principal whose policy only grants the actions in step 3.

3. Create a Policy for the Access Key

Open the app menu (the grid icon at the top left) and select Access Control.
Click Policies in the sidebar.
In the Object storage access tab, click Create policy and enter a Policy name.

In the Statement section, enter a Name for the statement, select Allow access, and specify the following:
- Principals: The user or principal associated with the access key. Choose it by name or email, or enter its ID, for example coreweave/<user-UID>.
- Actions: s3:GetObject. To use Cloud-synced folders, also s3:ListBucket.
- Resources: The bucket you created for Encord to use, and the objects in it (<bucket-name> and <bucket-name>/*). Use bucket names, not ARNs.

Click Create policy.

This organization access policy is all Encord needs. You don’t need a bucket policy. Bucket policies are optional and cannot be applied in the CoreWeave Console. If your organization requires bucket-level controls, see CoreWeave’s bucket policy documentation.

CoreWeave policies grant access to principals (users), not to individual access keys:

Every access key created by the same user has the same access. To keep two Encord integrations isolated from each other, create their access keys under different principals.
A broad policy, such as one that allows s3:* on all resources for all principals (*), gives the access key access to every bucket in your organization, regardless of the policy you create here. Review your existing policies under Access Control > Policies to make sure no other policy grants wider access than intended.

Applying Encord required CORS settings may overwrite existing configurations on your cloud storage bucket. If your bucket already has CORS settings, make sure to append Encord’s required settings instead of replacing them.

A CORS configuration must be applied to your CoreWeave bucket. This enables Encord to request your files from a web browser. Without it, no files display in Encord, including images. Videos fail to load with Failed to access video asset. Please check your integration configuration. CORS cannot be configured in the CoreWeave Console. Apply it with the S3 API, for example using the AWS CLI. See CoreWeave’s CORS documentation.

Save the CORS configuration for your region as cors.json. This is the policy shown under 4. Set CORS permissions in the Encord integration dialog, wrapped in CORSRules for the AWS CLI.

{
    "CORSRules": [
        {
            "AllowedHeaders": [
                "If-Modified-Since",
                "If-None-Match",
                "If-Range",
                "Range"
            ],
            "AllowedMethods": [
                "GET",
                "HEAD"
            ],
            "AllowedOrigins": [
                "https://app.encord.com",
                "https://api.encord.com",
                "https://api.us.encord.com",
                "https://app.us.encord.com"
            ],
            "ExposeHeaders": [
                "Content-Length",
                "Content-Range",
                "Accept-Ranges",
                "ETag",
                "Content-Type",
                "Last-Modified"
            ],
            "MaxAgeSeconds": 3600
        }
    ]
}

{
    "CORSRules": [
        {
            "AllowedHeaders": [
                "If-Modified-Since",
                "If-None-Match",
                "If-Range",
                "Range"
            ],
            "AllowedMethods": [
                "GET",
                "HEAD"
            ],
            "AllowedOrigins": [
                "https://app.encord.com",
                "https://api.encord.com"
            ],
            "ExposeHeaders": [
                "Content-Length",
                "Content-Range",
                "Accept-Ranges",
                "ETag",
                "Content-Type",
                "Last-Modified"
            ],
            "MaxAgeSeconds": 3600
        }
    ]
}

{
    "CORSRules": [
        {
            "AllowedHeaders": [
                "If-Modified-Since",
                "If-None-Match",
                "If-Range",
                "Range"
            ],
            "AllowedMethods": [
                "GET",
                "HEAD"
            ],
            "AllowedOrigins": [
                "https://api.us.encord.com",
                "https://app.us.encord.com"
            ],
            "ExposeHeaders": [
                "Content-Length",
                "Content-Range",
                "Accept-Ranges",
                "ETag",
                "Content-Type",
                "Last-Modified"
            ],
            "MaxAgeSeconds": 3600
        }
    ]
}

These rules allow byte-range requests (GET/HEAD) and expose the range and caching headers — Content-Range, Content-Length, Accept-Ranges, ETag, Content-Type, Last-Modified — that videos and large scene files (such as MCAP) need in order to stream in chunks directly in the browser.

Configure an AWS CLI profile with a CoreWeave access key that your organization policy allows to perform s3:PutBucketCORS on the bucket. If you scoped the key from step 2 to read-only access, use a different key. When prompted, enter the Key ID and Key secret, and leave the region and output format empty. CoreWeave requires virtual-hosted addressing.
aws configure --profile coreweave aws configure set endpoint_url https://cwobject.com --profile coreweave aws configure set s3.addressing_style virtual --profile coreweave

Apply the configuration to your bucket. Run the command from the folder that contains cors.json.

aws s3api put-bucket-cors --bucket <bucket-name> --cors-configuration file://cors.json --profile coreweave

Verify the configuration.

aws s3api get-bucket-cors --bucket <bucket-name> --profile coreweave

5. Set Up the Integration in Encord

Click the Encord logo at the top left and select Workspace settings.
Click Integrations > Cloud buckets in the sidebar.

Click New integration.

The Add integration dialog appears.

Select CoreWeave as the Integration provider.

Provide the following:
- 1. Integration title: A meaningful name for the integration.
- 2. Create an account for Encord in IAM: Enter the CoreWeave Key ID as the Account access key ID and the Key secret as the Account secret access key (from step 2), and the bucket’s Zone (for example, US-EAST-04A). Keep the pre-filled endpoint https://cwobject.com.

The access key can be found under Access Control > Object storage access keys in CoreWeave.
The bucket URL and zone can be found under Infra Control > Data and storage, in the Object storage tab, in CoreWeave.

3. Give the account read access to the desired buckets and 4. Set CORS permissions refer to the policy in step 3 and the CORS configuration in step 4. Complete them in CoreWeave if you have not done so already.

Optionally, under Advanced Settings, set a Custom signed url expiration time.

Click Create integration. The dialog continues to Add cloud sync folder. Use a virtual-hosted storage path, as described in Register CoreWeave Data.

6. Test the Integration

Click the Run a test button on the integration.
Paste the virtual-hosted URL of any object in the bucket, for example https://<bucket-name>.cwobject.com/<path>/image.png, and click Check Encord can access this URI. If the test is successful a green tick appears next to Encord infrastructure and This machine.
- Encord infrastructure checks that Encord can read the object with your access key and policy.
- This machine checks that your browser can load the object, which requires the CORS configuration. If it fails with “It is likely CORS has been misconfigured”, apply CORS to this bucket.

If This machine shows “Cache policy is not set”, your objects have no Cache-Control header. Files still load, but the browser cannot reuse cached copies, which can make data load slowly in the Label Editor. Set the header when you upload files, or update existing objects. Both require an access key that is allowed s3:PutObject on the bucket, not the read-only key used by Encord:

# New uploads
aws s3 cp <local-folder> s3://<bucket-name>/<path>/ --recursive --cache-control "max-age=86400" --profile coreweave

# Existing objects (copies each object onto itself with the new header)
aws s3 cp s3://<bucket-name>/<path>/ s3://<bucket-name>/<path>/ --recursive --cache-control "max-age=86400" --metadata-directive REPLACE --profile coreweave

The s3://<bucket-name>/<path> addresses are AWS CLI syntax only. The coreweave profile sends them to https://<bucket-name>.cwobject.com/<path>. In Encord, always use the https:// URL.Replacing metadata can change each object’s Content-Type, so check it afterwards with aws s3api head-object --bucket <bucket-name> --key <path>/<file> --profile coreweave.

To use Cloud-synced folders, paste the bucket URL, for example https://<bucket-name>.cwobject.com, and click Check Encord can access this directory. This checks that the access key can list the bucket (s3:ListBucket).

The test confirms what the access key can access, not what it is restricted from. A passing test on a bucket the integration should not reach means another policy grants wider access. See Create a Policy for the Access Key.

The following errors can appear:

Error	Description
Connection failed	Verify the Account access key ID, Account secret access key, endpoint, and Zone are correct.
Permission denied	Ensure the access key has `s3:GetObject` permissions.
Region errors	Make sure the Zone matches the zone of your bucket.
It is likely CORS has been misconfigured	Apply the CORS configuration to the bucket.
Cache policy is not set	Set a `Cache-Control` header on your objects. See the warning in step 2 above.

Register CoreWeave Data

We recommend setting the expiration time for signed URLs to be greater than the time it takes to complete an annotation task.

Navigate to the Register cloud data page for guidance on how to register files stored in CoreWeave. CoreWeave AI Object Storage requires virtual-hosted style URLs, with the bucket name in the hostname. Use this format for object URLs and for the Storage path of Cloud-synced folders.

Format	Example	Supported
Virtual-hosted	`https://my-bucket.cwobject.com/images/`	Yes
Path-style	`https://cwobject.com/my-bucket/images/`	No
S3 protocol	`s3://my-bucket/images/`	No

You cannot change the storage path of a Cloud-synced folder after it is created. A folder created with a path-style or s3:// storage path fails to sync, and must be deleted and created again with a virtual-hosted URL.

Get Started

Data

Fundamentals

Annotate & Review

Label and Model Evaluation

Users and Workspaces

1. Create a Bucket in CoreWeave

2. Create an Access Key in CoreWeave

3. Create a Policy for the Access Key

5. Set Up the Integration in Encord

6. Test the Integration

Register CoreWeave Data

​1. Create a Bucket in CoreWeave

​2. Create an Access Key in CoreWeave

​3. Create a Policy for the Access Key

​4. Allow Cross-origin resource sharing (CORS)

​5. Set Up the Integration in Encord

​6. Test the Integration

​Register CoreWeave Data

1. Create a Bucket in CoreWeave

2. Create an Access Key in CoreWeave

3. Create a Policy for the Access Key

4. Allow Cross-origin resource sharing (CORS)

5. Set Up the Integration in Encord

6. Test the Integration

Register CoreWeave Data