AWS SigV4 authentication requires AWS credentials. Please pr

Error message

AWS SigV4 authentication requires AWS credentials. Please provide either:
1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
2. Provide accessKeyId and secretAccessKey in options
3. Use a credentialProvider function
4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option
Original error: ${errorMessage}

What it means

Identical to error 120 but in createAmazonBedrockAnthropic: the wrapped credential failure mentions AWS_ACCESS_KEY_ID or accessKeyId, so the provider rethrows the full list of the four supported authentication methods. No credentials at all were found for the Bedrock Anthropic provider.

Source

Thrown at packages/amazon-bedrock/src/anthropic/amazon-bedrock-anthropic-provider.ts:215

            secretAccessKey: loadSetting({
              settingValue: options.secretAccessKey,
              settingName: 'secretAccessKey',
              environmentVariableName: 'AWS_SECRET_ACCESS_KEY',
              description: 'AWS secret access key',
            }),
            sessionToken: loadOptionalSetting({
              settingValue: options.sessionToken,
              environmentVariableName: 'AWS_SESSION_TOKEN',
            }),
          };
        } catch (error) {
          const errorMessage =
            error instanceof Error ? error.message : String(error);
          if (
            errorMessage.includes('AWS_ACCESS_KEY_ID') ||
            errorMessage.includes('accessKeyId')
          ) {
            throw new Error(
              'AWS SigV4 authentication requires AWS credentials. Please provide either:\n' +
                '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n' +
                '2. Provide accessKeyId and secretAccessKey in options\n' +
                '3. Use a credentialProvider function\n' +
                '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\n' +
                `Original error: ${errorMessage}`,
            );
          }
          if (
            errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||
            errorMessage.includes('secretAccessKey')
          ) {
            throw new Error(
              'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +
                'Please ensure both credentials are provided.\n' +
                `Original error: ${errorMessage}`,
            );
          }

View on GitHub (pinned to 69428b1f8b)

Solutions

Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables.
Pass accessKeyId and secretAccessKey in createAmazonBedrockAnthropic options.
Supply a credentialProvider function returning valid credentials.
Or use API key auth via AWS_BEARER_TOKEN_BEDROCK env var or the apiKey option.

Example fix

// before
const anthropic = createAmazonBedrockAnthropic();
// after
const anthropic = createAmazonBedrockAnthropic({
  region: 'us-east-1',
  accessKeyId: process.env.AWS_ACCESS_KEY_ID!,
  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,
});

Defensive patterns

Strategy: validation

Validate before calling

function assertAnthropicBedrockAuth(opts) {
  const hasEnv = !!process.env.AWS_ACCESS_KEY_ID && !!process.env.AWS_SECRET_ACCESS_KEY;
  const hasOpts = !!opts?.accessKeyId && !!opts?.secretAccessKey;
  const hasProvider = typeof opts?.credentialProvider === 'function';
  const hasApiKey = !!opts?.apiKey || !!process.env.AWS_BEARER_TOKEN_BEDROCK;
  if (!hasEnv && !hasOpts && !hasProvider && !hasApiKey) {
    throw new Error('createAmazonBedrockAnthropic: no auth method configured.');
  }
}

Type guard

function hasAuth(o: unknown): boolean {
  const c = o as any;
  return !!(c?.accessKeyId && c?.secretAccessKey) || typeof c?.credentialProvider === 'function' || !!c?.apiKey;
}

Try / catch

try {
  const anthropic = createAmazonBedrockAnthropic(options);
} catch (error) {
  if (error instanceof Error && error.message.includes('SigV4 authentication requires')) {
    // configure credentials and retry once
  } else {
    throw error;
  }
}

Prevention

Centralize Bedrock auth configuration in a shared factory reused by both provider variants.
Validate auth options at app startup, not lazily at first model call.
Document required env vars for deployments using the anthropic sub-provider.

When it happens

Trigger: Calling createAmazonBedrockAnthropic()/amazonBedrockAnthropic(modelId) with none of: AWS env vars, accessKeyId/secretAccessKey options, credentialProvider, apiKey/AWS_BEARER_TOKEN_BEDROCK — and the underlying error message matching 'AWS_ACCESS_KEY_ID' or 'accessKeyId'.

Common situations: Deploying to an environment without AWS credentials; switching from the main bedrock provider to the anthropic sub-provider and forgetting to copy credential options; missing env vars in serverless functions.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/26dc161f3215ff31. Report an issue: GitHub.