What causes "not a valid bedrock api key" in charmbracelet/crush?

Set the Bedrock key to a valid AWS access key ID starting with 'ABSK' (e.g. ABSK... key form used by this integration).

not a valid bedrock api key

Error message

not a valid bedrock api key

What it means

During provider API-key validation, Bedrock has no cheap HTTP endpoint to verify keys (the /foundation-models authorization is region-specific), so the validator falls back to a prefix check: the key must start with 'ABSK'. Any Bedrock-configured key that doesn't start with ABSK fails immediately with this error without a network call.

Source

Thrown at internal/config/config.go:1005

			testURL = baseURL + "/v1/models"
		default:
			testURL = baseURL + "/models"
		}

		headers["x-api-key"] = apiKey
		headers["anthropic-version"] = "2023-06-01"
	case catwalk.TypeGoogle:
		baseURL, _ := resolver.ResolveValue(c.BaseURL)
		baseURL = cmp.Or(baseURL, "https://generativelanguage.googleapis.com")
		testURL = baseURL + "/v1beta/models?key=" + url.QueryEscape(apiKey)
	case catwalk.TypeBedrock:
		// NOTE: Bedrock has a `/foundation-models` endpoint that we could in
		// theory use, but apparently the authorization is region-specific,
		// so it's not so trivial.
		if strings.HasPrefix(apiKey, "ABSK") { // Bedrock API keys
			return nil
		}
		return errors.New("not a valid bedrock api key")
	case catwalk.TypeVercel:
		// NOTE: Vercel does not validate API keys on the `/models` endpoint.
		if strings.HasPrefix(apiKey, "vck_") { // Vercel API keys
			return nil
		}
		return errors.New("not a valid vercel api key")
	}

	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
	defer cancel()

	client := &http.Client{}
	req, err := http.NewRequestWithContext(ctx, "GET", testURL, nil)
	if err != nil {
		return fmt.Errorf("failed to create request for provider %s: %w", c.ID, err)
	}
	for k, v := range headers {
		req.Header.Set(k, v)

View on GitHub (pinned to 7944b8e522)

Solutions

Set the Bedrock key to a valid AWS access key ID starting with 'ABSK' (e.g. ABSK... key form used by this integration).
Check the env var/secret actually resolves: echo it and confirm no stray whitespace, quotes, or unresolved ${VAR}.
Confirm the provider entry really is Bedrock; if you're using an AWS sigv4/profile setup, configure it per the Bedrock provider docs instead of an apikey field.

Example fix

// before (crushrc)
provider bedrock mybedrock {
  apikey "${AWS_SESSION_TOKEN}" // wrong credential
}
// after
provider bedrock mybedrock {
  apikey "ABSK..." // valid key id with ABSK prefix
}

Defensive patterns

Strategy: validation

Validate before calling

apiKey := os.Getenv("BEDROCK_API_KEY")
if !strings.HasPrefix(strings.TrimSpace(apiKey), "ABSK") {
    return fmt.Errorf("bedrock key must start with ABSK, got %q", apiKey[:min(4, len(apiKey))])
}

Try / catch

if err := config.ValidateAPIKey(ctx, providerCfg); err != nil {
    if strings.Contains(err.Error(), "bedrock") {
        return fmt.Errorf("check BEDROCK key format (must start with ABSK): %w", err)
    }
    return err
}

Prevention

Store the correct credential kind: Bedrock access key (ABSK...), not session tokens or secret keys.
Echo the resolved env var at setup time to catch unresolved ${VAR} or stray whitespace.
Keep AWS credentials in a dedicated profile/env block and avoid copy-paste truncation.

When it happens

Trigger: Configuring a provider of type bedrock whose resolved API key does not begin with the string 'ABSK' — e.g. pasting an AWS access key ID in the wrong format, using a session token instead of the key, or a key with leading whitespace/env-var expansion issues.

Common situations: Mixing up AWS credentials: using a secret access key or session token rather than the access key ID; typos or truncated keys; templated env vars (${VAR}) that didn't resolve; non-AWS Bedrock-compatible endpoints with different key formats.

Related errors

AI-assisted analysis of charmbracelet/crush@7944b8e522 (2026-08-29). Data as JSON: /api/errors/2f553bc997d765d3. Report an issue: GitHub.