@ai-sdk/amazon-bedrock 3.0.0-beta.5 → 3.0.0-beta.7

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @ai-sdk/amazon-bedrock
 
+## 3.0.0-beta.7
+
+### Patch Changes
+
+- 314edb2: Add API key authentication support for Amazon Bedrock with Bearer token and automatic SigV4 fallback
+
+## 3.0.0-beta.6
+
+### Patch Changes
+
+- Updated dependencies [05d2819]
+  - @ai-sdk/provider-utils@3.0.0-beta.3
+
 ## 3.0.0-beta.5
 
 ### Patch Changes

package/README.md

@@ -19,6 +19,81 @@ You can import the default provider instance `bedrock` from `@ai-sdk/amazon-bedr
 import { bedrock } from '@ai-sdk/amazon-bedrock';
 ```
 
+## Authentication
+
+The Amazon Bedrock provider supports two authentication methods with automatic fallback:
+
+### API Key Authentication (Recommended)
+
+API key authentication provides a simpler setup process compared to traditional AWS SigV4 authentication. You can authenticate using either environment variables or direct configuration.
+
+#### Using Environment Variable
+
+Set the `AWS_BEARER_TOKEN_BEDROCK` environment variable with your API key:
+
+```bash
+export AWS_BEARER_TOKEN_BEDROCK=your-api-key-here
+```
+
+```ts
+import { bedrock } from '@ai-sdk/amazon-bedrock';
+import { generateText } from 'ai';
+
+const { text } = await generateText({
+  model: bedrock('anthropic.claude-3-haiku-20240307-v1:0'),
+  prompt: 'Write a vegetarian lasagna recipe for 4 people.',
+  // API key is automatically loaded from AWS_BEARER_TOKEN_BEDROCK
+});
+```
+
+#### Using Direct Configuration
+
+You can also pass the API key directly in the provider configuration:
+
+```ts
+import { bedrock } from '@ai-sdk/amazon-bedrock';
+import { generateText } from 'ai';
+
+const bedrockWithApiKey = bedrock.withSettings({
+  apiKey: process.env.AWS_BEARER_TOKEN_BEDROCK, // or your API key directly
+  region: 'us-east-1', // Optional: specify region
+});
+
+const { text } = await generateText({
+  model: bedrockWithApiKey('anthropic.claude-3-haiku-20240307-v1:0'),
+  prompt: 'Write a vegetarian lasagna recipe for 4 people.',
+});
+```
+
+### SigV4 Authentication (Fallback)
+
+If no API key is provided, the provider automatically falls back to AWS SigV4 authentication using standard AWS credentials:
+
+```ts
+import { bedrock } from '@ai-sdk/amazon-bedrock';
+import { generateText } from 'ai';
+
+// Uses AWS credentials from environment variables or AWS credential chain
+const { text } = await generateText({
+  model: bedrock('anthropic.claude-3-haiku-20240307-v1:0'),
+  prompt: 'Write a vegetarian lasagna recipe for 4 people.',
+});
+```
+
+This method requires standard AWS environment variables:
+
+- `AWS_ACCESS_KEY_ID`
+- `AWS_SECRET_ACCESS_KEY`
+- `AWS_SESSION_TOKEN` (optional, for temporary credentials)
+
+### Authentication Precedence
+
+The provider uses the following authentication precedence:
+
+1. **API key from direct configuration** (`apiKey` in `withSettings()`)
+2. **API key from environment variable** (`AWS_BEARER_TOKEN_BEDROCK`)
+3. **SigV4 authentication** (AWS credential chain fallback)
+
 ## Example
 
 ```ts

package/dist/index.d.mts

@@ -30,6 +30,30 @@ interface AmazonBedrockProviderSettings {
      */
     region?: string;
     /**
+  API key for authenticating requests using Bearer token authentication.
+  When provided, this will be used instead of AWS SigV4 authentication.
+  Defaults to the value of the `AWS_BEARER_TOKEN_BEDROCK` environment variable.
+  
+  @example
+  ```typescript
+  // Using API key directly
+  const bedrock = createAmazonBedrock({
+    apiKey: 'your-api-key-here',
+    region: 'us-east-1'
+  });
+  
+  // Using environment variable AWS_BEARER_TOKEN_BEDROCK
+  const bedrock = createAmazonBedrock({
+    region: 'us-east-1'
+  });
+  ```
+  
+  Note: When `apiKey` is provided, it takes precedence over AWS SigV4 authentication.
+  If neither `apiKey` nor `AWS_BEARER_TOKEN_BEDROCK` environment variable is set,
+  the provider will fall back to AWS SigV4 authentication using AWS credentials.
+     */
+    apiKey?: string;
+    /**
   The AWS access key ID to use for the Bedrock provider. Defaults to the value of the
   `AWS_ACCESS_KEY_ID` environment variable.
      */

package/dist/index.d.ts

@@ -30,6 +30,30 @@ interface AmazonBedrockProviderSettings {
      */
     region?: string;
     /**
+  API key for authenticating requests using Bearer token authentication.
+  When provided, this will be used instead of AWS SigV4 authentication.
+  Defaults to the value of the `AWS_BEARER_TOKEN_BEDROCK` environment variable.
+  
+  @example
+  ```typescript
+  // Using API key directly
+  const bedrock = createAmazonBedrock({
+    apiKey: 'your-api-key-here',
+    region: 'us-east-1'
+  });
+  
+  // Using environment variable AWS_BEARER_TOKEN_BEDROCK
+  const bedrock = createAmazonBedrock({
+    region: 'us-east-1'
+  });
+  ```
+  
+  Note: When `apiKey` is provided, it takes precedence over AWS SigV4 authentication.
+  If neither `apiKey` nor `AWS_BEARER_TOKEN_BEDROCK` environment variable is set,
+  the provider will fall back to AWS SigV4 authentication using AWS credentials.
+     */
+    apiKey?: string;
+    /**
   The AWS access key ID to use for the Bedrock provider. Defaults to the value of the
   `AWS_ACCESS_KEY_ID` environment variable.
      */

package/dist/index.js

@@ -1350,10 +1350,28 @@ function prepareBodyString(body) {
     return JSON.stringify(body);
   }
 }
+function createApiKeyFetchFunction(apiKey, fetch = globalThis.fetch) {
+  return async (input, init) => {
+    const originalHeaders = extractHeaders(init == null ? void 0 : init.headers);
+    return fetch(input, {
+      ...init,
+      headers: (0, import_provider_utils6.removeUndefinedEntries)(
+        (0, import_provider_utils6.combineHeaders)(originalHeaders, {
+          Authorization: `Bearer ${apiKey}`
+        })
+      )
+    });
+  };
+}
 
 // src/bedrock-provider.ts
 function createAmazonBedrock(options = {}) {
-  const sigv4Fetch = createSigV4FetchFunction(async () => {
+  const rawApiKey = (0, import_provider_utils7.loadOptionalSetting)({
+    settingValue: options.apiKey,
+    environmentVariableName: "AWS_BEARER_TOKEN_BEDROCK"
+  });
+  const apiKey = rawApiKey && rawApiKey.trim().length > 0 ? rawApiKey.trim() : void 0;
+  const fetchFunction = apiKey ? createApiKeyFetchFunction(apiKey, options.fetch) : createSigV4FetchFunction(async () => {
     const region = (0, import_provider_utils7.loadSetting)({
       settingValue: options.region,
       settingName: "region",
@@ -1361,30 +1379,58 @@ function createAmazonBedrock(options = {}) {
       description: "AWS region"
     });
     if (options.credentialProvider) {
+      try {
+        return {
+          ...await options.credentialProvider(),
+          region
+        };
+      } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `AWS credential provider failed: ${errorMessage}. Please ensure your credential provider returns valid AWS credentials with accessKeyId and secretAccessKey properties.`
+        );
+      }
+    }
+    try {
       return {
-        ...await options.credentialProvider(),
-        region
+        region,
+        accessKeyId: (0, import_provider_utils7.loadSetting)({
+          settingValue: options.accessKeyId,
+          settingName: "accessKeyId",
+          environmentVariableName: "AWS_ACCESS_KEY_ID",
+          description: "AWS access key ID"
+        }),
+        secretAccessKey: (0, import_provider_utils7.loadSetting)({
+          settingValue: options.secretAccessKey,
+          settingName: "secretAccessKey",
+          environmentVariableName: "AWS_SECRET_ACCESS_KEY",
+          description: "AWS secret access key"
+        }),
+        sessionToken: (0, import_provider_utils7.loadOptionalSetting)({
+          settingValue: options.sessionToken,
+          environmentVariableName: "AWS_SESSION_TOKEN"
+        })
       };
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      if (errorMessage.includes("AWS_ACCESS_KEY_ID") || errorMessage.includes("accessKeyId")) {
+        throw new Error(
+          `AWS SigV4 authentication requires AWS credentials. Please provide either:
+1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
+2. Provide accessKeyId and secretAccessKey in options
+3. Use a credentialProvider function
+4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option
+Original error: ${errorMessage}`
+        );
+      }
+      if (errorMessage.includes("AWS_SECRET_ACCESS_KEY") || errorMessage.includes("secretAccessKey")) {
+        throw new Error(
+          `AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Please ensure both credentials are provided.
+Original error: ${errorMessage}`
+        );
+      }
+      throw error;
     }
-    return {
-      region,
-      accessKeyId: (0, import_provider_utils7.loadSetting)({
-        settingValue: options.accessKeyId,
-        settingName: "accessKeyId",
-        environmentVariableName: "AWS_ACCESS_KEY_ID",
-        description: "AWS access key ID"
-      }),
-      secretAccessKey: (0, import_provider_utils7.loadSetting)({
-        settingValue: options.secretAccessKey,
-        settingName: "secretAccessKey",
-        environmentVariableName: "AWS_SECRET_ACCESS_KEY",
-        description: "AWS secret access key"
-      }),
-      sessionToken: (0, import_provider_utils7.loadOptionalSetting)({
-        settingValue: options.sessionToken,
-        environmentVariableName: "AWS_SESSION_TOKEN"
-      })
-    };
   }, options.fetch);
   const getBaseUrl = () => {
     var _a, _b;
@@ -1402,7 +1448,7 @@ function createAmazonBedrock(options = {}) {
     return new BedrockChatLanguageModel(modelId, {
       baseUrl: getBaseUrl,
       headers: (_a = options.headers) != null ? _a : {},
-      fetch: sigv4Fetch,
+      fetch: fetchFunction,
       generateId: import_provider_utils7.generateId
     });
   };
@@ -1419,7 +1465,7 @@ function createAmazonBedrock(options = {}) {
     return new BedrockEmbeddingModel(modelId, {
       baseUrl: getBaseUrl,
       headers: (_a = options.headers) != null ? _a : {},
-      fetch: sigv4Fetch
+      fetch: fetchFunction
     });
   };
   const createImageModel = (modelId) => {
@@ -1427,7 +1473,7 @@ function createAmazonBedrock(options = {}) {
     return new BedrockImageModel(modelId, {
       baseUrl: getBaseUrl,
       headers: (_a = options.headers) != null ? _a : {},
-      fetch: sigv4Fetch
+      fetch: fetchFunction
     });
   };
   provider.languageModel = createChatModel;