AWS SigV4 authentication requires AWS credentials. Please pr

Error message

AWS SigV4 authentication requires AWS credentials. Please provide either:
1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
2. Provide accessKeyId and secretAccessKey in options
3. Use a credentialProvider function
4. Use API key authentication with ANTHROPIC_AWS_API_KEY or apiKey option
Original error: ${errorMessage}

What it means

When SigV4 signing fails because the resolved AWS credentials lack an access key ID, the library re-throws this descriptive error listing the four supported ways to supply credentials. The original underlying error message is appended. It exists to turn opaque SigV4 failures into actionable guidance.

Source

Thrown at packages/anthropic-aws/src/anthropic-aws-provider.ts:187

            secretAccessKey: loadSetting({
              settingValue: options.secretAccessKey,
              settingName: 'secretAccessKey',
              environmentVariableName: 'AWS_SECRET_ACCESS_KEY',
              description: 'AWS secret access key',
            }),
            sessionToken: loadOptionalSetting({
              settingValue: options.sessionToken,
              environmentVariableName: 'AWS_SESSION_TOKEN',
            }),
          };
        } catch (error) {
          const errorMessage =
            error instanceof Error ? error.message : String(error);
          if (
            errorMessage.includes('AWS_ACCESS_KEY_ID') ||
            errorMessage.includes('accessKeyId')
          ) {
            throw new Error(
              'AWS SigV4 authentication requires AWS credentials. Please provide either:\n' +
                '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n' +
                '2. Provide accessKeyId and secretAccessKey in options\n' +
                '3. Use a credentialProvider function\n' +
                '4. Use API key authentication with ANTHROPIC_AWS_API_KEY or apiKey option\n' +
                `Original error: ${errorMessage}`,
            );
          }
          if (
            errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||
            errorMessage.includes('secretAccessKey')
          ) {
            throw new Error(
              'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +
                'Please ensure both credentials are provided.\n' +
                `Original error: ${errorMessage}`,
            );
          }

View on GitHub (pinned to 69428b1f8b)

Solutions

Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in the environment.
Pass `accessKeyId`/`secretAccessKey` directly in createAnthropicAws options.
Supply a `credentialProvider` function that returns valid credentials.
Or use API-key auth: set ANTHROPIC_AWS_API_KEY env var or the `apiKey` option.

Example fix

// before
const anthropic = createAnthropicAws({ baseURL: '...' }); // no credentials anywhere
// after
const anthropic = createAnthropicAws({
  accessKeyId: process.env.AWS_ACCESS_KEY_ID,
  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
  region: 'us-east-1',
});

Defensive patterns

Strategy: validation

Validate before calling

if (!process.env.AWS_ACCESS_KEY_ID || !process.env.AWS_SECRET_ACCESS_KEY) {
  throw new Error('Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY before calling createAnthropicAws');
}

Type guard

function hasEnvAwsCreds(env: NodeJS.ProcessEnv): env is NodeJS.ProcessEnv & { AWS_ACCESS_KEY_ID: string; AWS_SECRET_ACCESS_KEY: string } {
  return Boolean(env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY);
}

Try / catch

try {
  const anthropic = createAnthropicAws(opts);
} catch (e) {
  if (e instanceof Error && e.message.includes('AWS SigV4 authentication requires AWS credentials')) {
    // supply env vars, options credentials, credentialProvider, or apiKey
  }
  throw e;
}

Prevention

Validate AWS env vars at app startup.
Use one canonical credential source (env, options, or provider).
In serverless, confirm the execution role's env/credentials are attached.
Prefer IAM roles over static keys where possible.

When it happens

Trigger: `createAnthropicAws` resolves credentials (env, options, or provider) and the signing step throws an error whose message contains 'AWS_ACCESS_KEY_ID' or 'accessKeyId' — i.e., the access key is missing entirely.

Common situations: Deploying to an environment without AWS_ACCESS_KEY_ID set; typo'd env var names; passing `accessKey` instead of `accessKeyId` in options; Lambda/container role env not propagated.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/da152615cc5895c2. Report an issue: GitHub.