{"record":{"id":"2f553bc997d765d3","repo":"charmbracelet/crush","slug":"not-a-valid-bedrock-api-key","errorCode":null,"errorMessage":"not a valid bedrock api key","messagePattern":"not a valid bedrock api key","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/config/config.go","lineNumber":1005,"sourceCode":"\t\t\ttestURL = baseURL + \"/v1/models\"\n\t\tdefault:\n\t\t\ttestURL = baseURL + \"/models\"\n\t\t}\n\n\t\theaders[\"x-api-key\"] = apiKey\n\t\theaders[\"anthropic-version\"] = \"2023-06-01\"\n\tcase catwalk.TypeGoogle:\n\t\tbaseURL, _ := resolver.ResolveValue(c.BaseURL)\n\t\tbaseURL = cmp.Or(baseURL, \"https://generativelanguage.googleapis.com\")\n\t\ttestURL = baseURL + \"/v1beta/models?key=\" + url.QueryEscape(apiKey)\n\tcase catwalk.TypeBedrock:\n\t\t// NOTE: Bedrock has a `/foundation-models` endpoint that we could in\n\t\t// theory use, but apparently the authorization is region-specific,\n\t\t// so it's not so trivial.\n\t\tif strings.HasPrefix(apiKey, \"ABSK\") { // Bedrock API keys\n\t\t\treturn nil\n\t\t}\n\t\treturn errors.New(\"not a valid bedrock api key\")\n\tcase catwalk.TypeVercel:\n\t\t// NOTE: Vercel does not validate API keys on the `/models` endpoint.\n\t\tif strings.HasPrefix(apiKey, \"vck_\") { // Vercel API keys\n\t\t\treturn nil\n\t\t}\n\t\treturn errors.New(\"not a valid vercel api key\")\n\t}\n\n\tctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)\n\tdefer cancel()\n\n\tclient := &http.Client{}\n\treq, err := http.NewRequestWithContext(ctx, \"GET\", testURL, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create request for provider %s: %w\", c.ID, err)\n\t}\n\tfor k, v := range headers {\n\t\treq.Header.Set(k, v)","sourceCodeStart":987,"sourceCodeEnd":1023,"githubUrl":"https://github.com/charmbracelet/crush/blob/7944b8e52225d8805e31eacbf7ef24856b0dfb7a/internal/config/config.go#L987-L1023","documentation":"During provider API-key validation, Bedrock has no cheap HTTP endpoint to verify keys (the /foundation-models authorization is region-specific), so the validator falls back to a prefix check: the key must start with 'ABSK'. Any Bedrock-configured key that doesn't start with ABSK fails immediately with this error without a network call.","triggerScenarios":"Configuring a provider of type bedrock whose resolved API key does not begin with the string 'ABSK' — e.g. pasting an AWS access key ID in the wrong format, using a session token instead of the key, or a key with leading whitespace/env-var expansion issues.","commonSituations":"Mixing up AWS credentials: using a secret access key or session token rather than the access key ID; typos or truncated keys; templated env vars (${VAR}) that didn't resolve; non-AWS Bedrock-compatible endpoints with different key formats.","solutions":["Set the Bedrock key to a valid AWS access key ID starting with 'ABSK' (e.g. ABSK... key form used by this integration).","Check the env var/secret actually resolves: echo it and confirm no stray whitespace, quotes, or unresolved ${VAR}.","Confirm the provider entry really is Bedrock; if you're using an AWS sigv4/profile setup, configure it per the Bedrock provider docs instead of an apikey field."],"exampleFix":"// before (crushrc)\nprovider bedrock mybedrock {\n  apikey \"${AWS_SESSION_TOKEN}\" // wrong credential\n}\n// after\nprovider bedrock mybedrock {\n  apikey \"ABSK...\" // valid key id with ABSK prefix\n}","handlingStrategy":"validation","validationCode":"apiKey := os.Getenv(\"BEDROCK_API_KEY\")\nif !strings.HasPrefix(strings.TrimSpace(apiKey), \"ABSK\") {\n    return fmt.Errorf(\"bedrock key must start with ABSK, got %q\", apiKey[:min(4, len(apiKey))])\n}","typeGuard":null,"tryCatchPattern":"if err := config.ValidateAPIKey(ctx, providerCfg); err != nil {\n    if strings.Contains(err.Error(), \"bedrock\") {\n        return fmt.Errorf(\"check BEDROCK key format (must start with ABSK): %w\", err)\n    }\n    return err\n}","preventionTips":["Store the correct credential kind: Bedrock access key (ABSK...), not session tokens or secret keys.","Echo the resolved env var at setup time to catch unresolved ${VAR} or stray whitespace.","Keep AWS credentials in a dedicated profile/env block and avoid copy-paste truncation."],"tags":["config","aws","bedrock","api-key","validation"],"backgroundTag":"invalid-api-key-format","analyzedSha":"7944b8e52225d8805e31eacbf7ef24856b0dfb7a","analyzedAt":"2026-08-29T12:48:59.079Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}