anthropic 1.80.0 → 2.3.0

data/lib/anthropic/client.rb

@@ -1,19 +1,16 @@
 # frozen_string_literal: true
 
 module Anthropic
-  @warned_explicit_shadow = false
   @warned_env_shadow = false
+  @warned_env_api_key_and_auth_token = false
 
   class << self
-    def warn_explicit_static_shadows_credentials(param)
-      return if @warned_explicit_shadow
-      @warned_explicit_shadow = true
+    # @api private
+    def warn_env_api_key_and_auth_token
+      return if @warned_env_api_key_and_auth_token
+      @warned_env_api_key_and_auth_token = true
 
-      warn(
-        "[anthropic-ruby] `#{param}:` was passed alongside `credentials:`; the static credential " \
-        "takes precedence and the credentials provider is silently disabled. " \
-        "Pass only one."
-      )
+      warn("Anthropic: ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN are both set. Using ANTHROPIC_API_KEY.")
     end
 
     def warn_env_static_shadows_auto_discovery(env_var)
@@ -67,9 +64,6 @@ module Anthropic
     # @return [Anthropic::Credentials::TokenCache, nil]
     attr_reader :token_cache
 
-    # @return [Anthropic::Resources::Completions]
-    attr_reader :completions
-
     # @return [Anthropic::Resources::Messages]
     attr_reader :messages
 
@@ -82,6 +76,9 @@ module Anthropic
     # @return [Anthropic::Resources::Skills]
     attr_reader :skills
 
+    # @return [Anthropic::Resources::UserProfiles]
+    attr_reader :user_profiles
+
     # @return [Anthropic::Resources::Organization]
     attr_reader :organization
 
@@ -95,7 +92,7 @@ module Anthropic
       headers = {}
 
       if @api_key
-        headers["x-api-key"] = @api_key
+        headers["authorization"] = "Bearer #{@api_key}" unless @api_key.empty?
       elsif @auth_token
         headers["authorization"] = "Bearer #{@auth_token}"
       elsif @token_cache
@@ -121,7 +118,7 @@ module Anthropic
       if expected_time > default_time || (max_nonstreaming_tokens && max_tokens > max_nonstreaming_tokens)
         raise ArgumentError.new(
           "Streaming is required for operations that may take longer than 10 minutes. " \
-          "See https://github.com/anthropics/anthropic-sdk-ruby#long-requests for more details"
+          "See https://platform.claude.com/docs/en/cli-sdks-libraries/sdks/ruby#streaming for more details"
         )
       end
 
@@ -138,11 +135,14 @@ module Anthropic
     # Credential precedence, matching the credential-resolution spec and
     # the Workload Identity Federation user guide:
     #
-    # 1. Explicit constructor arguments — +api_key:+, +auth_token:+,
-    #    +credentials:+, +config:+. If the caller passed any of these,
-    #    the SDK uses it and does *not* read credential env vars.
-    # 2. +ANTHROPIC_API_KEY+ / +ANTHROPIC_AUTH_TOKEN+ env vars. Only
-    #    consulted when no explicit credential argument was passed.
+    # 1. An explicit constructor argument — one of +api_key:+,
+    #    +auth_token:+, +credentials:+, +config:+. The SDK uses it and
+    #    does *not* fall back to credential env vars or profiles on disk.
+    #    Passing more than one raises +ArgumentError+.
+    # 2. +ANTHROPIC_API_KEY+, then +ANTHROPIC_AUTH_TOKEN+. Only
+    #    consulted when no explicit credential argument was passed. An
+    #    empty variable counts as unset. When both are set, the SDK warns
+    #    once per process.
     # 3. +ANTHROPIC_PROFILE+ — explicit profile selection.
     # 4. Direct env-var federation (+ANTHROPIC_IDENTITY_TOKEN[_FILE]+ +
     #    +ANTHROPIC_FEDERATION_RULE_ID+ + +ANTHROPIC_ORGANIZATION_ID+).
@@ -152,16 +152,11 @@ module Anthropic
     # A static env credential (step 2) *shadows* steps 3–5, silently
     # disabling profile / federation auto-discovery.
     #
-    # Passing an explicit +api_key:+ or +auth_token:+ *argument*
-    # alongside an explicit +credentials:+ is supported: the
-    # static credential takes precedence at the request-header level and
-    # the credentials provider is silently disabled.
-    #
     # @param api_key [String, nil] Defaults to +ENV["ANTHROPIC_API_KEY"]+ when
     #   no explicit credential argument is passed.
     #
     # @param auth_token [String, nil] Defaults to +ENV["ANTHROPIC_AUTH_TOKEN"]+ when
-    #   no explicit credential argument is passed.
+    #   no explicit credential argument is passed and +ANTHROPIC_API_KEY+ is not set.
     #
     # @param credentials [#call, nil] Credential provider — any callable returning
     #   +AccessToken.new(token:, expires_at:)+. The provider is wrapped in a
@@ -171,9 +166,8 @@ module Anthropic
     #
     # @param config [Hash, nil] In-memory configuration hash with the same shape
     #   as +configs/<profile>.json+. Must include an +authentication+ object with
-    #   a +type+ field (+oidc_federation+ or +user_oauth+). Mutually exclusive
-    #   with +credentials:+. For +user_oauth+, must also include
-    #   +authentication.credentials_path+.
+    #   a +type+ field (+oidc_federation+ or +user_oauth+). For +user_oauth+,
+    #   must also include +authentication.credentials_path+.
     #
     # @param webhook_key [String, nil] Defaults to `ENV["ANTHROPIC_WEBHOOK_SIGNING_KEY"]`
     #
@@ -227,6 +221,9 @@ module Anthropic
     # @param middleware [Array<#call>, #call, nil] Per-attempt HTTP around-middleware. Each
     #   entry is a `#call(req, nxt) -> Anthropic::APIResponse` callable. See
     #   {Anthropic::Middleware}.
+    #
+    # @raise [ArgumentError] If more than one of +api_key:+, +auth_token:+,
+    #   +credentials:+, +config:+ is passed.
     def initialize(
       api_key: nil,
       auth_token: nil,
@@ -245,19 +242,18 @@ module Anthropic
       @timeout_overridden = !timeout.nil?
       timeout ||= self.class::DEFAULT_TIMEOUT_IN_SECONDS
 
-      if config && credentials
-        raise ArgumentError, "Pass at most one of `credentials:` or `config:`."
+      credential =
+        {api_key: api_key, auth_token: auth_token, credentials: credentials, config: config}.compact
+      if credential.length > 1
+        raise ArgumentError,
+              "Pass at most one of `api_key:`, `auth_token:`, `credentials:`, or `config:`. " \
+              "Received #{credential.keys.map { "`#{_1}:`" }.join(', ')}."
       end
 
-      has_explicit_credential = api_key || auth_token || credentials || config
-
-      if !has_explicit_credential && resolve_default_credentials?
-        api_key = ENV["ANTHROPIC_API_KEY"]
-        auth_token = ENV["ANTHROPIC_AUTH_TOKEN"]
-      end
+      credential = env_credential if credential.empty? && resolve_default_credentials?
 
-      @api_key = api_key&.to_s
-      @auth_token = auth_token&.to_s
+      @api_key = credential[:api_key]&.to_s
+      @auth_token = credential[:auth_token]&.to_s
       @credentials = nil
       @token_cache = nil
 
@@ -267,30 +263,29 @@ module Anthropic
 
       credential_headers = {}
 
-      if config
-        in_memory = Anthropic::Credentials::InMemoryConfig.new(config)
-        @credentials = in_memory
-        credential_headers = in_memory.extra_headers
-        if !base_url_is_explicit && in_memory.resolved_base_url
-          base_url = in_memory.resolved_base_url
+      result =
+        case credential
+        in {credentials:}
+          Anthropic::Credentials::CredentialResult.new(provider: credentials)
+        in {config:}
+          in_memory = Anthropic::Credentials::InMemoryConfig.new(config)
+          Anthropic::Credentials::CredentialResult.new(
+            provider: in_memory,
+            extra_headers: in_memory.extra_headers,
+            base_url: in_memory.resolved_base_url
+          )
+        in {} if resolve_default_credentials?
+          Anthropic::Credentials.default_credentials(base_url: base_url || "https://api.anthropic.com")
+        in {api_key: _} | {auth_token: _} | {}
+          nil
         end
-      else
-        @credentials = credentials
-      end
 
-      if @credentials.nil? && @api_key.nil? && @auth_token.nil? && resolve_default_credentials?
-        default_base_url = base_url || "https://api.anthropic.com"
-        result = Anthropic::Credentials.default_credentials(base_url: default_base_url)
-        if result
-          @credentials = result.provider
-          credential_headers = result.extra_headers
-          base_url = result.base_url if !base_url_is_explicit && result.base_url
-        end
+      if result
+        @credentials = result.provider
+        credential_headers = result.extra_headers
+        base_url = result.base_url if !base_url_is_explicit && result.base_url
       end
 
-      warn_explicit_shadow(api_key: api_key, auth_token: auth_token, credentials: credentials || config)
-      warn_env_shadow(api_key: api_key, auth_token: auth_token) if resolve_default_credentials?
-
       if @credentials
         @token_cache = Anthropic::Credentials::TokenCache.new(@credentials)
       end
@@ -309,7 +304,7 @@ module Anthropic
       end
 
       headers = {
-        "anthropic-version" => "2023-06-01"
+        "anthropic-version" => "2026-10-21"
       }
       custom_headers_env = ENV["ANTHROPIC_CUSTOM_HEADERS"]
       unless custom_headers_env.nil?
@@ -337,11 +332,11 @@ module Anthropic
         middleware: middleware
       )
 
-      @completions = Anthropic::Resources::Completions.new(client: self)
       @messages = Anthropic::Resources::Messages.new(client: self)
       @models = Anthropic::Resources::Models.new(client: self)
       @files = Anthropic::Resources::Files.new(client: self)
       @skills = Anthropic::Resources::Skills.new(client: self)
+      @user_profiles = Anthropic::Resources::UserProfiles.new(client: self)
       @organization = Anthropic::Resources::Organization.new(client: self)
       @beta = Anthropic::Resources::Beta.new(client: self)
     end
@@ -360,6 +355,14 @@ module Anthropic
       super
     end
 
+    # @api private
+    #
+    # Whether the platform this client talks to has message threads. Platform clients whose
+    # platform has none override this.
+    #
+    # @return [Boolean]
+    def message_threads? = true
+
     private
 
     # @api private
@@ -367,7 +370,7 @@ module Anthropic
     # Whether to resolve credentials from the default chain (the static
     # +ANTHROPIC_API_KEY+ / +ANTHROPIC_AUTH_TOKEN+ env vars and the shared
     # config store / federation auto-discovery, precedence steps 2–5 above)
-    # when no explicit credential argument is passed. Called once from
+    # when no explicit credential argument is passed. Called from
     # {#initialize}, so overrides must not depend on subclass instance state.
     # Subclasses that bring their own auth scheme override this to +false+ so
     # ambient first-party credentials are never resolved or folded into
@@ -379,21 +382,23 @@ module Anthropic
     # @return [Boolean]
     def resolve_default_credentials? = true
 
-    def warn_explicit_shadow(api_key:, auth_token:, credentials:)
-      return if credentials.nil?
-
-      Anthropic.warn_explicit_static_shadows_credentials("api_key") if api_key
-      Anthropic.warn_explicit_static_shadows_credentials("auth_token") if auth_token
-    end
+    # @api private
+    #
+    # Precedence step 2 above, with its warnings.
+    #
+    # @return [Hash{Symbol=>String}] +{api_key: ...}+, +{auth_token: ...}+ or +{}+
+    def env_credential
+      present =
+        {api_key: "ANTHROPIC_API_KEY", auth_token: "ANTHROPIC_AUTH_TOKEN"}.reject { ENV[_2].to_s.empty? }
+      Anthropic.warn_env_api_key_and_auth_token if present.length > 1
 
-    def warn_env_shadow(api_key:, auth_token:)
-      return unless Anthropic::Credentials.auto_discoverable_credentials?
+      option, env_var = present.first
+      return {} if option.nil?
 
-      if api_key && ENV["ANTHROPIC_API_KEY"]
-        Anthropic.warn_env_static_shadows_auto_discovery("ANTHROPIC_API_KEY")
+      if Anthropic::Credentials.auto_discoverable_credentials?
+        Anthropic.warn_env_static_shadows_auto_discovery(env_var)
       end
-      return unless auth_token && ENV["ANTHROPIC_AUTH_TOKEN"]
-      Anthropic.warn_env_static_shadows_auto_discovery("ANTHROPIC_AUTH_TOKEN")
+      {option => ENV[env_var]}
     end
   end
 end

data/lib/anthropic/credentials.rb

@@ -19,9 +19,9 @@ module Anthropic
       # Implements steps 2-5 of the spec precedence chain (step 1 is handled at
       # the client constructor level):
       #
-      # Step 2a: +ANTHROPIC_API_KEY+ -> return +nil+ so the client uses its
-      #          existing +X-Api-Key+ header path. (API keys are not Bearer
-      #          tokens, so they can't flow through this chain.)
+      # Step 2a: +ANTHROPIC_API_KEY+ -> return +nil+ so the client sends the
+      #          key itself. (A key needs no token cache or OAuth beta
+      #          header, so it doesn't flow through this chain.)
       # Step 2b: +ANTHROPIC_AUTH_TOKEN+ -> StaticToken (Bearer).
       # Step 3:  +ANTHROPIC_PROFILE+ set -> load that profile. This is
       #          *explicit profile selection* via env var; failures propagate.
@@ -45,7 +45,7 @@ module Anthropic
       # Returns +nil+ when nothing matches -- the client will fall back to
       # its normal "no auth configured" error.
       def default_credentials(base_url: DEFAULT_BASE_URL)
-        # Step 2a -- env api_key: return nil so the base client handles X-Api-Key.
+        # Step 2a -- env api_key: return nil so the base client sends the key.
         # Treat an empty string the same as unset, matching the Python client.
         unless ENV[ENV_API_KEY].to_s.empty?
           return nil

data/lib/anthropic/helpers/aws/client.rb

@@ -15,7 +15,7 @@ module Anthropic
         # Creates and returns a new client for interacting with Anthropic models via the AWS gateway.
         #
         # AWS credentials are resolved in priority order:
-        #   1. `api_key` constructor arg → API key mode (x-api-key header, no SigV4)
+        #   1. `api_key` constructor arg → API key mode (Authorization: Bearer header, no SigV4)
         #   2. `aws_access_key` + `aws_secret_access_key` args → SigV4 with explicit credentials
         #   3. `aws_profile` arg → SigV4 with named AWS profile
         #   4. `ANTHROPIC_AWS_API_KEY` env var → API key mode (only when no platform auth args given)
@@ -23,7 +23,7 @@ module Anthropic
         #
         # When `skip_auth` is true, all auth is skipped and workspace_id is not required.
         #
-        # @param api_key [String, nil] Anthropic API key (bypasses SigV4, uses x-api-key header)
+        # @param api_key [String, nil] Anthropic API key (bypasses SigV4, uses Authorization: Bearer header)
         #
         # @param aws_access_key [String, nil] AWS access key ID for SigV4 signing
         #
@@ -91,9 +91,9 @@ module Anthropic
 
           # In API-key mode the gateway key rides the base client's `api_key`
           # slot; {#resolve_default_credentials?} keeps first-party credential
-          # auto-discovery out of the picture when it is absent. The gateway
-          # serves the full first-party API, so every resource the parent wires
-          # up stays available.
+          # auto-discovery out of the picture when it is absent. Every resource
+          # the parent wires up stays available; {#build_request} rejects the
+          # one route the gateway does not serve.
           super(
             api_key: effective_api_key,
             base_url: resolved_base_url,
@@ -105,6 +105,23 @@ module Anthropic
           )
         end
 
+        # @api private
+        #
+        # Fails fast on user profile action URLs, which the gateway does not serve.
+        #
+        # @param req [Hash{Symbol=>Object}]
+        # @param opts [Hash{Symbol=>Object}]
+        # @return [Hash{Symbol=>Object}]
+        private def build_request(req, opts)
+          # Id-parameterized routes pass `path` as an Array whose first element
+          # is the format string (e.g. `["v1/user_profiles/%1$s/action_urls", id]`).
+          if Array(req[:path]).first.to_s.match?(%r{\Av1/user_profiles/[^/]+/action_urls})
+            raise NotImplementedError.new("User profile action URLs are not supported on the AWS gateway.")
+          end
+
+          super
+        end
+
         # @api private
         #
         # @return [String]

data/lib/anthropic/helpers/aws_auth.rb

@@ -40,10 +40,8 @@ module Anthropic
         workspace_id: nil,
         env_api_key_fallback: nil,
         env_workspace_id: nil,
-        env_workspace_id_fallback: nil,
-        use_bearer_auth: false
+        env_workspace_id_fallback: nil
       )
-        @use_bearer_auth = use_bearer_auth
         base_url = nil if base_url.to_s.empty?
         begin
           require("aws-sdk-core")
@@ -134,17 +132,12 @@ module Anthropic
         [effective_api_key, base_url]
       end
 
-      # Override the base client's auth_headers to prevent ANTHROPIC_API_KEY
-      # from leaking as an x-api-key header in SigV4 mode, and to send the API
-      # key as an Authorization: Bearer header when use_bearer_auth is set.
+      # Override the base client's auth_headers so that SigV4 mode sends no
+      # static credential.
       #
       # @return [Hash{String=>String}]
       private def auth_headers
         return {} if @use_sig_v4
-        if @use_bearer_auth
-          return {} if @api_key.nil?
-          return {"authorization" => "Bearer #{@api_key}"}
-        end
         super
       end
 

data/lib/anthropic/helpers/bedrock/client.rb

@@ -6,14 +6,9 @@ module Anthropic
       class Client < Anthropic::Client
         include Anthropic::Helpers::AWSAuth
 
-        DEFAULT_VERSION = "bedrock-2023-05-31"
-
         # @return [Anthropic::Resources::Messages]
         attr_reader :messages
 
-        # @return [Anthropic::Resources::Completions]
-        attr_reader :completions
-
         # @return [Anthropic::Resources::Beta]
         attr_reader :beta
 
@@ -33,6 +28,7 @@ module Anthropic
         #
         # @param aws_region [String, nil] Enforce the AWS Region to use. If unset, the region is set according to the
         #   AWS SDK's default resolution order, described at https://github.com/aws/aws-sdk-ruby?tab=readme-ov-file#configuration
+        #   With an API key, defaults to `ENV["AWS_REGION"]`, then `ENV["AWS_DEFAULT_REGION"]`.
         #
         # @param aws_access_key [String, nil]  Optional AWS access key to use for authentication. Overrides profile and credential provider chain
         #
@@ -123,7 +119,7 @@ module Anthropic
               credentials: @aws_credentials
             )
           else
-            @aws_region = aws_region
+            @aws_region = aws_region || env_lookup("AWS_REGION", "AWS_DEFAULT_REGION")
           end
 
           base_url = ENV["ANTHROPIC_BEDROCK_BASE_URL"] if base_url.to_s.empty?
@@ -132,7 +128,6 @@ module Anthropic
           # For AWSAuth#auth_headers: suppress key headers in SigV4 mode; in
           # API-key mode fall through to the base bearer-token handling.
           @use_sig_v4 = !@signer.nil?
-          @use_bearer_auth = false
 
           # The Bedrock bearer rides the base client's `auth_token` slot;
           # {#resolve_default_credentials?} keeps first-party credential
@@ -161,6 +156,11 @@ module Anthropic
           raise NotImplementedError.new(message)
         end
 
+        # @api private
+        #
+        # @return [Boolean]
+        def message_threads? = false
+
         def files
           raise NotImplementedError, "Files are not supported on Bedrock."
         end
@@ -169,6 +169,10 @@ module Anthropic
           raise NotImplementedError, "Skills are not supported on Bedrock."
         end
 
+        def user_profiles
+          raise NotImplementedError, "User profiles are not supported on Bedrock."
+        end
+
         # @api private
         #
         # @param req [Hash{Symbol=>Object}] .
@@ -306,25 +310,30 @@ module Anthropic
         private def validate_bedrock_request!(request_components)
           # Id-parameterized routes pass `path` as an Array whose first element
           # is the format string (e.g. `["v1/messages/batches/%1$s", id]`).
-          case Array(request_components[:path]).first.to_s
+          path = Array(request_components[:path]).first.to_s
+          beta = request_components.dig(:qualifiers, :beta) == "true" || path.include?("?beta=true")
+          case path
           in %r{^v1/messages/batches}
             message = "The Batch API is not supported in Bedrock yet"
             raise NotImplementedError.new(message)
           in %r{v1/messages/count_tokens}
             message = "Token counting is not supported in Bedrock yet"
             raise NotImplementedError.new(message)
-          in %r{v1/models\?beta=true}
+          in %r{v1/models(\?|\z)} if beta
             # rubocop:disable Layout/LineLength
             message = "Please instead use https://docs.anthropic.com/en/api/claude-on-amazon-bedrock#list-available-models to list available models on Bedrock."
             # rubocop:enable Layout/LineLength
             raise NotImplementedError.new(message)
+          in %r{^v1/user_profiles}
+            raise NotImplementedError.new("User profiles are not supported on Bedrock.")
           else
           end
         end
 
         # @api private
         #
-        # Rewrites the canonical Anthropic request into Bedrock's shape — drops
+        # Rewrites the canonical Anthropic request into Bedrock's shape — moves
+        # the `anthropic-version` header into the body, drops
         # `:model`/`:stream` from the body and retargets the URL to
         # `/model/{model}/invoke[-with-response-stream]`. Called from
         # {#provider_middleware}, so user middleware sees the canonical
@@ -334,17 +343,17 @@ module Anthropic
         # @param req [Anthropic::APIRequest]
         # @return [Anthropic::APIRequest]
         private def adapt_request(req)
+          version = req.headers["anthropic-version"]
+          req = req.with(headers: req.headers.except("anthropic-version"))
           body = req.body
           return req unless body.is_a?(Hash)
 
           body = body.transform_keys("anthropic-beta": :anthropic_beta)
-          body[:anthropic_version] ||= DEFAULT_VERSION
+          body[:anthropic_version] ||= version if version
 
           path = req.url.path.to_s
           query = req.url.query
-          messages_route =
-            (path.end_with?("/v1/messages") && (query.nil? || query == "beta=true")) ||
-            (path.end_with?("/v1/complete") && query.nil?)
+          messages_route = path.end_with?("/v1/messages") && (query.nil? || query == "beta=true")
 
           return req.with(body: body) unless req.method == :post && messages_route
 
@@ -353,7 +362,7 @@ module Anthropic
 
           url = req.url.dup
           url.path = path.sub(
-            %r{v1/(?:messages|complete)\z},
+            %r{v1/messages\z},
             stream ? "model/#{model}/invoke-with-response-stream" : "model/#{model}/invoke"
           )
           url.query = nil

data/lib/anthropic/helpers/bedrock/mantle_client.rb

@@ -9,7 +9,7 @@ module Anthropic
       # Auth is resolved by the same precedence as the AWS gateway client, with
       # Mantle-specific environment variables that fall back to the AWS equivalents:
       #
-      #   1. `api_key` constructor arg → API key mode (x-api-key header, no SigV4)
+      #   1. `api_key` constructor arg → API key mode (Authorization: Bearer header, no SigV4)
       #   2. `aws_access_key` + `aws_secret_access_key` args → SigV4 with explicit credentials
       #   3. `aws_profile` arg → SigV4 with named AWS profile
       #   4. `AWS_BEARER_TOKEN_BEDROCK` env (then `ANTHROPIC_AWS_API_KEY`) → API key mode
@@ -29,7 +29,7 @@ module Anthropic
         # Creates and returns a new client for interacting with Anthropic models via Bedrock Mantle.
         # Only the Messages API (/v1/messages) is supported.
         #
-        # @param api_key [String, nil] Anthropic API key (bypasses SigV4, uses x-api-key header)
+        # @param api_key [String, nil] Anthropic API key (bypasses SigV4, uses Authorization: Bearer header)
         #
         # @param aws_access_key [String, nil] AWS access key ID for SigV4 signing
         #
@@ -43,7 +43,6 @@ module Anthropic
         #   Defaults to `ENV["AWS_REGION"]`, then `ENV["AWS_DEFAULT_REGION"]`. Required in SigV4 mode.
         #
         # @param skip_auth [Boolean] When true, skip all auth.
-        #   Note: the base SDK may still send an X-Api-Key header if ANTHROPIC_API_KEY is set.
         #
         # @param base_url [String, nil] Override the default base URL for the API.
         #   Defaults to `ENV["ANTHROPIC_BEDROCK_MANTLE_BASE_URL"]`, then
@@ -88,8 +87,7 @@ module Anthropic
             service_name: "bedrock-mantle",
             env_api_key: "AWS_BEARER_TOKEN_BEDROCK",
             env_api_key_fallback: "ANTHROPIC_AWS_API_KEY",
-            derive_base_url: ->(region) { "https://bedrock-mantle.#{region}.api.aws/anthropic" },
-            use_bearer_auth: true
+            derive_base_url: ->(region) { "https://bedrock-mantle.#{region}.api.aws/anthropic" }
           )
 
           super(
@@ -107,18 +105,17 @@ module Anthropic
           @beta = MantleBeta.new(client: self)
         end
 
-        # Completions are not supported on Bedrock Mantle. Only Messages (/v1/messages) is supported.
-        def completions
-          raise NotImplementedError,
-                "Completions are not supported on Bedrock Mantle. Only Messages (/v1/messages) is supported."
-        end
-
         # Models listing is not supported on Bedrock Mantle. Only Messages (/v1/messages) is supported.
         def models
           raise NotImplementedError,
                 "Models listing is not supported on Bedrock Mantle. Only Messages (/v1/messages) is supported."
         end
 
+        # @api private
+        #
+        # @return [Boolean]
+        def message_threads? = false
+
         # Files are not supported on Bedrock Mantle. Only Messages (/v1/messages) is supported.
         def files
           raise NotImplementedError,
@@ -131,6 +128,13 @@ module Anthropic
                 "Skills are not supported on Bedrock Mantle. Only Messages (/v1/messages) is supported."
         end
 
+        # User profiles are not supported on Bedrock Mantle. Only Messages (/v1/messages) is supported.
+        def user_profiles
+          raise NotImplementedError,
+                "User profiles are not supported on Bedrock Mantle. " \
+                "Only Messages (/v1/messages) is supported."
+        end
+
         # @api private
         #
         # @return [Hash{String=>String}]
@@ -146,10 +150,36 @@ module Anthropic
         # @api private
         #
         # @return [#call]
-        private def provider_middleware = method(:aws_auth_provider)
+        private def provider_middleware
+          ->(req, nxt) { aws_auth_provider(adapt_request(req), nxt) }
+        end
+
+        # @api private
+        #
+        # Mantle drops custom request headers, so Messages and token counting send the user profile ID
+        # in the body.
+        #
+        # @param req [Anthropic::APIRequest]
+        # @return [Anthropic::APIRequest]
+        private def adapt_request(req)
+          path = req.url.path.to_s
+          return req unless req.method == :post && path.end_with?("/v1/messages", "/v1/messages/count_tokens")
+
+          body = req.body
+          profile_headers, headers = req.headers.partition do |name, _|
+            name.to_s.casecmp?("anthropic-user-profile-id")
+          end
+          user_profile_id = profile_headers.last&.last
+          return req if user_profile_id.to_s.empty? || !body.is_a?(Hash)
+
+          unless body.keys.any? { _1.to_s == "user_profile_id" }
+            body = {**body, user_profile_id: user_profile_id}
+          end
+          req.with(headers: headers.to_h, body: body)
+        end
 
         # Restricted Beta service that only exposes messages. Other beta resources
-        # (models, files, skills) are not supported on Bedrock Mantle.
+        # (models, files, skills, user profiles) are not supported on Bedrock Mantle.
         class MantleBeta
           # @return [Anthropic::Resources::Beta::Messages]
           attr_reader :messages
@@ -173,6 +203,12 @@ module Anthropic
             raise NotImplementedError,
                   "Beta skills are not supported on Bedrock Mantle. Only Messages (/v1/messages) is supported."
           end
+
+          def user_profiles
+            raise NotImplementedError,
+                  "Beta user profiles are not supported on Bedrock Mantle. " \
+                  "Only Messages (/v1/messages) is supported."
+          end
         end
       end
     end