warpdotdev/warp · error · anyhow::Error

Bedrock secrets require --bedrock-api-key and --region in no

Error message

Bedrock secrets require --bedrock-api-key and --region in non-interactive mode

What it means

read_bedrock_secret_value reads the Bedrock API key from --bedrock-api-key, falling back to an interactive password prompt when the flag is absent or empty. If stdin is not a terminal (no prompt possible) and the flag was not supplied, it errors listing the flags required for non-interactive use. Cancellation of the interactive prompt is not an error; only the missing-flag non-interactive case is.

Source

Thrown at app/src/ai/agent_sdk/secret.rs:678

                    Err(err) => return Err(err.into()),
                }
            }
        }
    };

    Ok(Some(ManagedSecretValue::openai_api_key(api_key, base_url)))
}

/// Read a Bedrock API key secret from dedicated CLI flags or interactive prompts.
fn read_bedrock_secret_value(
    bedrock_api_key: Option<String>,
    region: Option<String>,
) -> Result<Option<ManagedSecretValue>> {
    let api_key = match bedrock_api_key {
        Some(k) if !k.is_empty() => k,
        _ => {
            if !io::stdin().is_terminal() {
                return Err(anyhow::anyhow!(
                    "Bedrock secrets require --bedrock-api-key and --region in non-interactive mode"
                ));
            }
            let result = Password::new("Bedrock API key:")
                .with_display_toggle_enabled()
                .without_confirmation()
                .prompt();
            match result {
                Ok(value) if !value.is_empty() => value,
                Ok(_) => return Ok(None),
                Err(InquireError::OperationCanceled | InquireError::OperationInterrupted) => {
                    return Ok(None);
                }
                Err(err) => return Err(err.into()),
            }
        }
    };

View on GitHub (pinned to e72fd7aacb)

Solutions

1. Pass --bedrock-api-key (non-empty) and --region on the command line
2. Run the command in an interactive terminal to be prompted for the key
3. Guard scripts: fail fast if the key env var is empty before invoking the CLI

Example fix

# before (CI)
oz secret create bw --bedrock-api-key "$BW_KEY" --region us-east-1
# with BW_KEY unset -> Error: Bedrock secrets require --bedrock-api-key and --region in non-interactive mode

# after
: "${BW_KEY:?BW_KEY must be set}"
oz secret create bw --bedrock-api-key "$BW_KEY" --region us-east-1

fn noninteractive() -> bool { !std::io::stdin().is_terminal() }
if noninteractive() && (bedrock_api_key.as_deref().unwrap_or_default().is_empty()
    || region.as_deref().unwrap_or_default().is_empty()) {
    anyhow::bail!("non-interactive Bedrock create requires --bedrock-api-key and --region");
}

When it happens

Trigger: Creating a Bedrock API-key secret in CI, a pipe, or any non-TTY context without a non-empty --bedrock-api-key flag.

Common situations: CI provisioning of Bedrock secrets; scripts run with redirected stdin; empty-string flag values (e.g. unset env var expanded to '').

Related errors

• Bedrock access key secrets require --access-key-id, --secret
• Secret name is required. Usage: oz secret create <NAME>
• Refusing to delete secret without confirmation in non-intera
• Bedrock access key secrets cannot be updated via `--value`;
• Bedrock API key secrets cannot be updated via `--value`; re-

AI-assisted analysis of warpdotdev/warp@e72fd7aacb (2026-08-16). Data as JSON: /api/errors/38dfcabd2694204e. Report an issue: GitHub.