AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and

Error message

AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Please ensure both credentials are provided.
Original error: ${errorMessage}

What it means

If SigV4 signing fails specifically because the AWS secret access key is missing (underlying message mentions AWS_SECRET_ACCESS_KEY or secretAccessKey), the library throws this error indicating BOTH an access key ID and secret access key are required. The original error message is appended.

Source

Thrown at packages/anthropic-aws/src/anthropic-aws-provider.ts:200

            error instanceof Error ? error.message : String(error);
          if (
            errorMessage.includes('AWS_ACCESS_KEY_ID') ||
            errorMessage.includes('accessKeyId')
          ) {
            throw new Error(
              'AWS SigV4 authentication requires AWS credentials. Please provide either:\n' +
                '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n' +
                '2. Provide accessKeyId and secretAccessKey in options\n' +
                '3. Use a credentialProvider function\n' +
                '4. Use API key authentication with ANTHROPIC_AWS_API_KEY or apiKey option\n' +
                `Original error: ${errorMessage}`,
            );
          }
          if (
            errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||
            errorMessage.includes('secretAccessKey')
          ) {
            throw new Error(
              'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +
                'Please ensure both credentials are provided.\n' +
                `Original error: ${errorMessage}`,
            );
          }
          throw error;
        }
      }, options.fetch);

  const getBaseURL = (): string =>
    withoutTrailingSlash(options.baseURL) ??
    `https://aws-external-anthropic.${loadSetting({
      settingValue: options.region,
      settingName: 'region',
      environmentVariableName: 'AWS_REGION',
      description: 'AWS region',
    })}.api.aws/v1`;

View on GitHub (pinned to 69428b1f8b)

Solutions

Set AWS_SECRET_ACCESS_KEY alongside AWS_ACCESS_KEY_ID in the environment.
If passing credentials in options, include both accessKeyId and secretAccessKey.
If using credentialProvider, ensure the returned object includes secretAccessKey.
Verify the env var name spelling and that your process actually receives it (dotenv load, container secrets mount).

Example fix

// before
createAnthropicAws({ accessKeyId: 'AKIA...' }); // secret missing
// after
createAnthropicAws({
  accessKeyId: process.env.AWS_ACCESS_KEY_ID,
  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
  region: 'us-east-1',
});

Defensive patterns

Strategy: validation

Validate before calling

if (!process.env.AWS_SECRET_ACCESS_KEY) {
  throw new Error('AWS_SECRET_ACCESS_KEY is required for SigV4 authentication');
}

Type guard

function isCompleteAwsCreds(v: unknown): v is { accessKeyId: string; secretAccessKey: string } {
  return !!v && typeof v === 'object' && 'accessKeyId' in v && 'secretAccessKey' in v && typeof (v as any).secretAccessKey === 'string';
}

Try / catch

try {
  const anthropic = createAnthropicAws(opts);
} catch (e) {
  if (e instanceof Error && e.message.includes('requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY')) {
    // add the missing secret access key
  }
  throw e;
}

Prevention

Always set the secret key alongside the access key ID.
Check for env var name typos (AWS_SECRET_ACCESSKEY etc.).
Validate both credentials at config-load time.
When loading from a secrets manager, assert the full credential pair.

When it happens

Trigger: Credentials resolution finds an accessKeyId but no secretAccessKey — e.g., only AWS_ACCESS_KEY_ID set in the environment, or an options/provider result containing only one of the pair.

Common situations: Half-configured env (secret var unset or misspelled like AWS_SECRET_ACCESSKEY); credentials object constructed with only accessKeyId; secrets manager returning a partial record.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/4172ca0c22404c3e. Report an issue: GitHub.