warpdotdev/warp · error · anyhow::Error

Bedrock API key secrets cannot be updated via `--value`; re-

Error message

Bedrock API key secrets cannot be updated via `--value`; re-create the secret instead

What it means

Same generic-update gate as the access-key case, but for secrets whose server type is AnthropicBedrockApiKey: the raw-string path cannot construct the structured Bedrock API-key value. The comment notes the caller should use the dedicated Bedrock creation flow, so update-with---value is permanently unsupported for this type.

Source

Thrown at app/src/ai/agent_sdk/secret.rs:602

fn make_secret_value_from_gql_type(
    gql_type: ManagedSecretType,
    raw: &str,
) -> Result<ManagedSecretValue> {
    match gql_type {
        ManagedSecretType::RawValue | ManagedSecretType::Dotenvx => {
            Ok(ManagedSecretValue::raw_value(raw))
        }
        ManagedSecretType::AnthropicApiKey => Ok(ManagedSecretValue::anthropic_api_key(raw)),
        ManagedSecretType::AnthropicBedrockAccessKey => {
            // Bedrock access key secrets cannot be updated through the generic raw-string path.
            Err(anyhow::anyhow!(
                "Bedrock access key secrets cannot be updated via `--value`; re-create the secret instead"
            ))
        }
        ManagedSecretType::AnthropicBedrockApiKey => {
            // Bedrock secrets cannot be updated through the generic raw-string path.
            // The caller should use the dedicated Bedrock creation flow instead.
            Err(anyhow::anyhow!(
                "Bedrock API key secrets cannot be updated via `--value`; re-create the secret instead"
            ))
        }
        ManagedSecretType::OpenaiApiKey => Ok(ManagedSecretValue::openai_api_key(raw, None)),
    }
}

/// Read an OpenAI API key secret from CLI flags or interactive prompts.
///
/// The API key value is read from `--value-file`, stdin, or an interactive password prompt (in
/// that order), matching the behavior of other simple secret types.
///
/// `base_url` is optional. When `--base-url` is provided we use it verbatim (an empty value is
/// treated as "no base URL"). When it is not provided and we are running interactively, we
/// prompt for it; pressing Enter at the prompt skips the base URL. In non-interactive mode we
/// silently default to no base URL, since the vast majority of users use the provider's default
/// endpoint.
fn read_openai_api_key_secret_value(

View on GitHub (pinned to e72fd7aacb)

Solutions

  1. Delete and re-create the secret with the dedicated Bedrock flags: --bedrock-api-key and --region (both required non-interactively)
  2. Automate rotation as delete+create rather than update for Bedrock secrets

Example fix

# before
oz secret update bedrock-key --value $KEY
# Error: Bedrock API key secrets cannot be updated via `--value`; re-create the secret instead

# after
oz secret delete bedrock-key --force
oz secret create bedrock-key --bedrock-api-key $KEY --region us-east-1
Defensive patterns

Strategy: type-guard

Validate before calling

let t = find_secret_type(&secrets, &name, &owner).context("secret not found")?;
if matches!(t, ManagedSecretType::AnthropicBedrockApiKey | ManagedSecretType::AnthropicBedrockAccessKey) {
    anyhow::bail!("'{name}' is a Bedrock secret: rotate via delete + re-create with --bedrock-api-key/--region");
}

Type guard

fn updatable_via_value(t: ManagedSecretType) -> bool {
    !matches!(
        t,
        ManagedSecretType::AnthropicBedrockApiKey | ManagedSecretType::AnthropicBedrockAccessKey
    )
}

Try / catch

match update_secret(name, value).await {
    Err(e) if e.to_string().contains("re-create the secret") => {
        delete_secret(name, Force(true)).await?;
        create_bedrock_api_key_secret(name, key, region).await?;
    }
    rest => rest?,
}

Prevention

When it happens

Trigger: oz secret update <name> --value ... on a secret whose server-reported type is AnthropicBedrockApiKey.

Common situations: Rotating a Bedrock API key with the same command used for raw secrets; secrets originally created through the dedicated bedrock create flow.

Related errors

AI-assisted analysis of warpdotdev/warp@e72fd7aacb (2026-08-16). Data as JSON: /api/errors/6acf01ca624ec570. Report an issue: GitHub.