@ai-sdk/anthropic 4.0.89 → 4.0.91

package/docs/05-anthropic.mdx

@@ -97,10 +97,12 @@ You can use the following optional settings to customize the Anthropic provider
   It defaults to the `ANTHROPIC_API_KEY` environment variable.
   Only one of `apiKey` or `authToken` is required.
 
-- **authToken** _string_
+- **authToken** _string | PromiseLike<string> | (() => string | PromiseLike<string>)_
 
   Auth token that is being sent using the `Authorization: Bearer` header.
-  It defaults to the `ANTHROPIC_AUTH_TOKEN` environment variable.
+  Pass a function to resolve a token for each request, including short-lived
+  tokens managed by an external credential provider. This setting does not
+  enable OAuth beta headers; configure any required headers explicitly.
   Only one of `apiKey` or `authToken` is required.
 
 - **headers** _Record<string,string>_
@@ -114,6 +116,76 @@ You can use the following optional settings to customize the Anthropic provider
   You can use it as a middleware to intercept requests,
   or to provide a custom fetch implementation for e.g. testing.
 
+### Workload identity federation
+
+Use an `authToken` callback to connect the Anthropic SDK's token exchange and
+cache helpers to the AI SDK. Configure your service account and federation rule
+first, as described in [Anthropic's workload identity federation guide](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation).
+
+The following example uses the credential helpers from `@anthropic-ai/sdk@0.129.0`:
+
+<InstallPackages packages="ai @ai-sdk/anthropic @anthropic-ai/sdk@0.129.0" />
+
+```ts
+import { createAnthropic } from '@ai-sdk/anthropic';
+import { identityTokenFromFile } from '@anthropic-ai/sdk/lib/credentials/identity-token';
+import { oidcFederationProvider } from '@anthropic-ai/sdk/lib/credentials/oidc-federation';
+import { TokenCache } from '@anthropic-ai/sdk/lib/credentials/token-cache';
+import { generateText } from 'ai';
+
+// Create the cache and provider once, then reuse them across requests.
+const tokenCache = new TokenCache(
+  oidcFederationProvider({
+    identityTokenProvider: identityTokenFromFile(
+      '/var/run/secrets/anthropic.com/token',
+    ),
+    federationRuleId: process.env.ANTHROPIC_FEDERATION_RULE_ID!,
+    organizationId: process.env.ANTHROPIC_ORGANIZATION_ID!,
+    serviceAccountId: process.env.ANTHROPIC_SERVICE_ACCOUNT_ID!,
+    // Set this when your rule requires a workspace or to select a specific one.
+    workspaceId: process.env.ANTHROPIC_WORKSPACE_ID,
+    baseURL: 'https://api.anthropic.com',
+    fetch: globalThis.fetch,
+  }),
+);
+
+const anthropic = createAnthropic({
+  authToken: () => tokenCache.getToken(),
+  headers: { 'anthropic-beta': 'oauth-2025-04-20' },
+});
+
+const { text } = await generateText({
+  model: anthropic('claude-opus-5-5'),
+  prompt: 'Explain workload identity federation in one sentence.',
+});
+```
+
+The AI SDK resolves `authToken` before each request and sends the returned token
+as a bearer credential. The Anthropic SDK helpers perform the OIDC exchange,
+cache the access token, and renew it as needed.
+
+Set the `oauth-2025-04-20` beta explicitly for these federated OAuth tokens,
+matching Anthropic's SDK. A bearer token or token callback alone does not imply
+workload identity federation. The exchange helper supplies its own token-endpoint
+headers. This example covers Messages API inference; it does not add WIF support
+to the Files, Skills, or Batch APIs, which have separate beta-header handling.
+
+Refresh is demand-driven: in the helper version above, `getToken()` starts a
+background exchange when the cached token has at most two minutes remaining,
+and waits for an exchange when at most 30 seconds remain. Concurrent requests
+share the pending exchange. Federation renews access by exchanging another
+identity token; it does not use a refresh token.
+
+Your workload's identity provider must supply fresh identity tokens. The file
+helper rereads the file on each exchange but does not rotate its contents.
+Anthropic rejects reuse of assertions with a `jti` by default, so arrange for a
+fresh assertion for each exchange. See the [WIF reference](https://platform.claude.com/docs/en/manage-claude/wif-reference)
+for token lifetimes and replay protection.
+
+This setup explicitly configures credentials; it does not enable the Anthropic
+client's automatic credential discovery or its invalidate-and-retry behavior on
+HTTP 401. Keep the helper version pinned and verify the integration when upgrading.
+
 ## Language Models
 
 You can create models that call the [Anthropic Messages API](https://docs.anthropic.com/claude/reference/messages_post) using the provider instance.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/anthropic",
-  "version": "4.0.89",
+  "version": "4.0.91",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -36,7 +36,7 @@
   },
   "dependencies": {
     "@ai-sdk/provider": "4.0.34",
-    "@ai-sdk/provider-utils": "5.0.69"
+    "@ai-sdk/provider-utils": "5.0.70"
   },
   "devDependencies": {
     "@ai-sdk/test-server": "2.0.4",

package/src/anthropic-files.ts

@@ -9,8 +9,10 @@ import {
   createJsonResponseHandler,
   lazySchema,
   postFormDataToApi,
+  resolve,
   zodSchema,
   type FetchFunction,
+  type Resolvable,
 } from '@ai-sdk/provider-utils';
 import { z } from 'zod/v4';
 import { anthropicFailedResponseHandler } from './anthropic-error';
@@ -32,7 +34,7 @@ const anthropicUploadFileResponseSchema = lazySchema(() =>
 interface AnthropicFilesConfig {
   provider: string;
   baseURL: string;
-  headers: () => Record<string, string | undefined>;
+  headers: Resolvable<Record<string, string | undefined>>;
   fetch?: FetchFunction;
 }
 
@@ -68,7 +70,7 @@ export class AnthropicFiles implements FilesV4 {
     const { value: response } = await postFormDataToApi({
       url: `${this.config.baseURL}/files`,
       headers: combineHeaders(
-        this.config.headers(),
+        await resolve(this.config.headers),
         { 'anthropic-beta': 'files-api-2025-04-14' },
         headers,
       ),

package/src/anthropic-language-model.ts

@@ -1151,15 +1151,17 @@ export class AnthropicLanguageModel implements LanguageModelV4 {
 
   private async getHeaders({
     betas,
+    configHeaders,
     headers,
     providerOptions,
   }: {
     betas: Set<string>;
+    configHeaders: Record<string, string | undefined> | undefined;
     headers: Record<string, string | undefined> | undefined;
     providerOptions: LanguageModelV4CallOptions['providerOptions'];
   }) {
     const combinedHeaders = combineHeaders(
-      this.config.headers ? await resolve(this.config.headers) : undefined,
+      configHeaders,
       headers,
       betas.size > 0 ? { 'anthropic-beta': Array.from(betas).join(',') } : {},
     );
@@ -1169,13 +1171,10 @@ export class AnthropicLanguageModel implements LanguageModelV4 {
       : combinedHeaders;
   }
 
-  private async getBetasFromHeaders(
+  private getBetasFromHeaders(
+    configHeaders: Record<string, string | undefined> | undefined,
     requestHeaders: Record<string, string | undefined> | undefined,
   ) {
-    const configHeaders = this.config.headers
-      ? await resolve(this.config.headers)
-      : undefined;
-
     const configBetaHeader = configHeaders?.['anthropic-beta'] ?? '';
     const requestBetaHeader = requestHeaders?.['anthropic-beta'] ?? '';
 
@@ -1249,6 +1248,10 @@ export class AnthropicLanguageModel implements LanguageModelV4 {
   async doGenerate(
     options: LanguageModelV4CallOptions,
   ): Promise<LanguageModelV4GenerateResult> {
+    const configHeaders = this.config.headers
+      ? await resolve(this.config.headers)
+      : undefined;
+
     const {
       args,
       warnings,
@@ -1260,7 +1263,10 @@ export class AnthropicLanguageModel implements LanguageModelV4 {
     } = await this.getArgs({
       ...options,
       stream: false,
-      userSuppliedBetas: await this.getBetasFromHeaders(options.headers),
+      userSuppliedBetas: this.getBetasFromHeaders(
+        configHeaders,
+        options.headers,
+      ),
     });
 
     // Extract citation documents for response processing
@@ -1279,6 +1285,7 @@ export class AnthropicLanguageModel implements LanguageModelV4 {
       url: this.buildRequestUrl(false),
       headers: await this.getHeaders({
         betas,
+        configHeaders,
         headers: options.headers,
         providerOptions: options.providerOptions,
       }),
@@ -1896,6 +1903,10 @@ export class AnthropicLanguageModel implements LanguageModelV4 {
   ): Promise<LanguageModelV4StreamResult> {
     'use step';
 
+    const configHeaders = this.config.headers
+      ? await resolve(this.config.headers)
+      : undefined;
+
     const {
       args: body,
       warnings,
@@ -1907,7 +1918,10 @@ export class AnthropicLanguageModel implements LanguageModelV4 {
     } = await this.getArgs({
       ...options,
       stream: true,
-      userSuppliedBetas: await this.getBetasFromHeaders(options.headers),
+      userSuppliedBetas: this.getBetasFromHeaders(
+        configHeaders,
+        options.headers,
+      ),
     });
 
     // Extract citation documents for response processing
@@ -1923,6 +1937,7 @@ export class AnthropicLanguageModel implements LanguageModelV4 {
       url,
       headers: await this.getHeaders({
         betas,
+        configHeaders,
         headers: options.headers,
         providerOptions: options.providerOptions,
       }),

package/src/anthropic-provider.ts

@@ -12,10 +12,12 @@ import {
   generateId,
   loadApiKey,
   loadOptionalSetting,
+  resolve,
   validateBaseURL,
   withoutTrailingSlash,
   withUserAgentSuffix,
   type FetchFunction,
+  type Resolvable,
 } from '@ai-sdk/provider-utils';
 import { Experimental_DecisionLanguageModel as DecisionLanguageModel } from '@ai-sdk/provider-utils/experimental-decision';
 import { AnthropicFiles } from './anthropic-files';
@@ -103,10 +105,11 @@ export interface AnthropicProviderSettings {
 
   /**
    * Auth token that is being sent using the `Authorization: Bearer` header.
-   * It defaults to the `ANTHROPIC_AUTH_TOKEN` environment variable.
+   * Can be a string, a promise, or a function returning either. Functions are
+   * called before each request to support short-lived tokens and token refresh.
    * Only one of `apiKey` or `authToken` is required.
    */
-  authToken?: string;
+  authToken?: Resolvable<string>;
 
   /**
    * Custom headers to include in the requests.
@@ -157,18 +160,8 @@ export function createAnthropic(
     });
   }
 
-  const getHeaders = () => {
-    const authHeaders: Record<string, string> = options.authToken
-      ? { Authorization: `Bearer ${options.authToken}` }
-      : {
-          'x-api-key': loadApiKey({
-            apiKey: options.apiKey,
-            environmentVariableName: 'ANTHROPIC_API_KEY',
-            description: 'Anthropic',
-          }),
-        };
-
-    return withUserAgentSuffix(
+  const createHeaders = (authHeaders: Record<string, string>) =>
+    withUserAgentSuffix(
       {
         'anthropic-version': '2023-06-01',
         ...authHeaders,
@@ -176,6 +169,28 @@ export function createAnthropic(
       },
       `ai-sdk-anthropic/${VERSION}`,
     );
+
+  const getHeaders = () => {
+    const authToken = options.authToken;
+
+    if (authToken) {
+      const token = typeof authToken === 'function' ? authToken() : authToken;
+      const createBearerHeaders = (token: string) =>
+        createHeaders({ Authorization: `Bearer ${token}` });
+
+      // Keep synchronous credentials serializable across workflow boundaries.
+      return typeof token === 'string'
+        ? createBearerHeaders(token)
+        : resolve(token).then(createBearerHeaders);
+    }
+
+    return createHeaders({
+      'x-api-key': loadApiKey({
+        apiKey: options.apiKey,
+        environmentVariableName: 'ANTHROPIC_API_KEY',
+        description: 'Anthropic',
+      }),
+    });
   };
 
   const languageModelConfig = {

package/src/skills/anthropic-skills.ts

@@ -41,16 +41,14 @@ export class AnthropicSkills implements SkillsV4 {
   private async fetchVersionMetadata({
     skillId,
     version,
-    headers,
   }: {
     skillId: string;
     version: string;
-    headers: Record<string, string | undefined>;
   }): Promise<{ name?: string; description?: string }> {
     const { value: versionResponse } = await getFromApi({
       url: `${this.config.baseURL}/skills/${encodePathSegment(skillId)}/versions/${encodePathSegment(version)}`,
       validateUrl: false,
-      headers,
+      headers: await this.getHeaders(),
       failedResponseHandler: anthropicFailedResponseHandler,
       successfulResponseHandler: createJsonResponseHandler(
         anthropicSkillVersionResponseSchema,
@@ -86,11 +84,9 @@ export class AnthropicSkills implements SkillsV4 {
       );
     }
 
-    const headers = await this.getHeaders();
-
     const { value: response } = await postFormDataToApi({
       url: `${this.config.baseURL}/skills`,
-      headers,
+      headers: await this.getHeaders(),
       formData,
       failedResponseHandler: anthropicFailedResponseHandler,
       successfulResponseHandler: createJsonResponseHandler(
@@ -104,7 +100,6 @@ export class AnthropicSkills implements SkillsV4 {
         ? await this.fetchVersionMetadata({
             skillId: response.id,
             version: response.latest_version,
-            headers,
           })
         : {};