JuliusBrussee/caveman · error

bedrock: missing credential

Error message

bedrock: missing credential

What it means

Error "bedrock: missing credential" thrown in JuliusBrussee/caveman.

Source

Thrown at proxy/providers/bedrock/signing.go:147

		return "", fmt.Errorf("bedrock: exact request payload hash is unavailable")
	}
	defer body.Close()
	raw, err := io.ReadAll(body)
	if err != nil {
		return "", fmt.Errorf("bedrock: exact request payload hash is unavailable")
	}
	return awssig.HashPayload(raw), nil
}

func credentialAuthKind(credential providers.Credential) (string, error) {
	kind := strings.ToLower(strings.TrimSpace(credential.AuthKind))
	switch kind {
	case "bedrock_api_key", "aws_access_keys":
		return kind, nil
	case "":
		key := strings.TrimSpace(credential.Key)
		if key == "" {
			return "", fmt.Errorf("bedrock: missing credential")
		}
		// Backward compatibility for existing x-cave-upstream-key and stored
		// connection values. A complete colon-form credential remains IAM. An
		// AKIA/ASIA-looking partial value fails as IAM instead of being sent as a
		// bearer. Every other opaque value is a Bedrock API key.
		if _, err := parseAWSCredentials(key); err == nil {
			return "aws_access_keys", nil
		}
		if strings.HasPrefix(key, "AKIA") || strings.HasPrefix(key, "ASIA") {
			return "aws_access_keys", nil
		}
		return "bedrock_api_key", nil
	default:
		return "", fmt.Errorf("bedrock: unsupported credential auth kind")
	}
}

// parseAWSCredentials decodes the "accessKeyId:secretAccessKey[:sessionToken]"

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Provide a Bedrock credential for signing.

When it happens

Trigger: Thrown at proxy/providers/bedrock/signing.go:147 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/0fb30c98bd0bc135. Report an issue: GitHub.