alibaba/open-code-review · error

bedrock rejected the token in AWS_BEARER_TOKEN_BEDROCK (%s):

Error message

bedrock rejected the token in AWS_BEARER_TOKEN_BEDROCK (%s): %w
  unset that variable to sign requests with SigV4 instead

What it means

explainError (internal/llm/client.go:1106) rewrites Bedrock API failures into actionable text. Bedrock rejects a malformed bearer token with an 'Invalid API Key format' complaint; when AWS_BEARER_TOKEN_BEDROCK is set, this branch matches that wording and blames the env var specifically, telling the user to unset it so requests fall back to SigV4 signing. It exists because the service's own wording misleadingly suggests an API key is missing when actually the provided token is bad.

Source

Thrown at internal/llm/client.go:1106

// model that is merely absent from the region reads as a malformed identifier.
// Non-Bedrock clients are unaffected — the error is returned untouched.
func (c *AnthropicClient) explainError(model string, err error) error {
	if err == nil || !c.bedrock {
		return err
	}
	msg := err.Error()
	where := c.bedrockWhere()

	// Order matters here, and the two AccessDenied shapes are why: Bedrock
	// answers both "your IAM policy forbids this" and "this account has not
	// enabled the model" with AccessDeniedException, and the fixes have nothing
	// in common. The specific wording is matched before the generic code.
	switch {
	// First: the bearer-token path produces this even when credentials are
	// otherwise valid, so a later "denied" branch would mislabel it.
	case strings.Contains(msg, "Invalid API Key format"):
		if os.Getenv("AWS_BEARER_TOKEN_BEDROCK") != "" {
			return fmt.Errorf("bedrock rejected the token in AWS_BEARER_TOKEN_BEDROCK (%s): %w\n"+
				"  unset that variable to sign requests with SigV4 instead", where, err)
		}
		return fmt.Errorf("bedrock rejected an API-key header rather than a signature (%s): %w\n"+
			"  no api_key applies to bedrock; this means a bearer token reached the request, not that a key is missing", where, err)
	case strings.Contains(msg, "don't have access to the model"):
		return fmt.Errorf("bedrock has no access enabled for model %q (%s): %w\n"+
			"  model access is granted per account and per region in the Bedrock console; an IAM policy alone does not enable it", model, where, err)
	case strings.Contains(msg, "model identifier is invalid"),
		strings.Contains(msg, "inference profile") && strings.Contains(msg, "not found"):
		return fmt.Errorf("bedrock rejected model %q (%s): %w\n"+
			"  run `aws bedrock list-inference-profiles%s` to see what this account offers — IDs are account- and region-scoped, and a version suffix such as -v1:0 is invalid for the newer families",
			model, where, err, listProfilesRegionArg(c.awsRegion))
	// Specific credential codes only. A bare "expired" would also claim an
	// expired TLS certificate is an SSO problem.
	case strings.Contains(msg, "ExpiredToken"), strings.Contains(msg, "ExpiredTokenException"),
		strings.Contains(msg, "SSOProviderInvalidToken"), strings.Contains(msg, "InvalidGrantException"),
		strings.Contains(msg, "NoCredentialProviders"), strings.Contains(msg, "failed to refresh cached credentials"):
		return fmt.Errorf("bedrock could not authenticate: AWS credentials are expired or unavailable (%s): %w\n"+

View on GitHub (pinned to 5cf97d0d15)

Solutions

1. Unset AWS_BEARER_TOKEN_BEDROCK (unset AWS_BEARER_TOKEN_BEDROCK) so requests use SigV4 signing with normal credentials
2. If a bearer token is required, re-copy a fresh Bedrock API key from the AWS console without truncation
3. Verify the token is a Bedrock key, not an Anthropic or OpenAI key
4. Re-source your shell profile after fixing so the stale export disappears

Example fix

// before
export AWS_BEARER_TOKEN_BEDROCK=sk-ant-api03-xxxx  # wrong provider's key
// after
unset AWS_BEARER_TOKEN_BEDROCK
export AWS_PROFILE=work && aws sso login --profile work  # SigV4 path

if tok := os.Getenv("AWS_BEARER_TOKEN_BEDROCK"); tok != "" && !strings.HasPrefix(tok, "bedrock-api-key") {
    return fmt.Errorf("AWS_BEARER_TOKEN_BEDROCK does not look like a Bedrock key; unset it to use SigV4")
}

_, err := cl.Call(ctx, messages)
if err != nil && strings.Contains(err.Error(), "AWS_BEARER_TOKEN_BEDROCK") {
    os.Unsetenv("AWS_BEARER_TOKEN_BEDROCK")
    return retryWithSigV4(ctx)
}

When it happens

Trigger: AWS_BEARER_TOKEN_BEDROCK contains a truncated, whitespace-mangled, expired, or non-Bedrock token and a bedrock-runtime InvokeModel call is made; the service answers 'Invalid API Key format' and explainError rewrites it with this message.

Common situations: User pasted an API key meant for the Anthropic API into AWS_BEARER_TOKEN_BEDROCK; token exported by a stale shell profile after rotating; copy-paste dropped characters; Bedrock API keys feature region mismatches.

Related errors

• bedrock rejected an API-key header rather than a signature (
• bedrock could not authenticate: AWS credentials are expired
• bedrock request failed (%s): %w
• llm.protocol cannot be %q: bedrock derives its host from aws
• %s does not apply to provider %q: aws_region and aws_profile

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/ef834fdf3cdaf368. Report an issue: GitHub.