support api key authentication for Bedrock API

[0x-fang]

AWS Bedrock has introduced API key support on 7/7, simplifying authentication for the Amazon Bedrock API. To enable this new feature in langchainjs, this update bumps the required "@aws-sdk/client-bedrock-runtime" version to "^3.840.0". It has been tested and worked as expected with new AWS_BEARER_TOKEN_BEDROCK environment variable.

• bump up the version of "@aws-sdk/client-bedrock-runtime" in package.json and update the yarn.lock
• update README file to add API key support feature for Bedrock.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
langchainjs-docs	✅ Ready (Inspect)	Visit Preview		Jul 8, 2025 4:57pm

1 Skipped Deployment

Name	Status	Preview	Comments	Updated (UTC)
langchainjs-api-refs	⬜️ Ignored (Inspect)			Jul 8, 2025 4:57pm

[Danny Avila (danny-avila)]

Is there any way to provide the API key without an environment variable? For example, similar to defining credentials object and providing accessKeyId from elsewhere like a database.

[Hassieb Pakzad (hassiebp)]

Is there any way to provide the API key without an environment variable? For example, similar to defining credentials object and providing accessKeyId from elsewhere like a database.

+1, would be great to decide on runtime what key to use rather than via env var

[Hunter Lovell (hntrl)]

Danny Avila (@danny-avila) Hassieb Pakzad (@hassiebp) good callout! Opened an issue to track here: #8532

(would love a PR to add support if you're up for it!)

[0x-fang]

Danny Avila (@danny-avila) Hassieb Pakzad (@hassiebp) actually there is one way with bedrock-runtime-client JS SDK only. you can create a client with token parameter, set authSchemePreference, and use it to call InvokeModel API without an environment variable.

const client = new BedrockRuntimeClient({
  token: { token: "<api-key>" },
  authSchemePreference: ["httpBearerAuth"],
});

const llm = new ChatBedrockConverse({
  model: "<my-model-id>",
  region: process.env.BEDROCK_AWS_REGION,
  client: client,
});

const res = await llm.invoke([
  ["system", "You are a helpful assistant."],
  ["human", "What is capital of France."],
]);

> {
  res: AIMessage {
    "id": "1e3bc241-6077-4bc3-b143-63651dc53911",
    "content": "The capital of France is Paris.",
    "additional_kwargs": {},
    "response_metadata": {
      "$metadata": {
        "httpStatusCode": 200,
        "requestId": "1e3bc241-6077-4bc3-b143-63651dc53911",
        "attempts": 1,
        "totalRetryDelay": 0
      },
      "metrics": {
        "latencyMs": 302
      },
      "stopReason": "end_turn",
      "usage": {
        "inputTokens": 19,
        "outputTokens": 10,
        "totalTokens": 29
      }
    },
    "tool_calls": [],
    "invalid_tool_calls": [],
    "usage_metadata": {
      "input_tokens": 19,
      "output_tokens": 10,
      "total_tokens": 29
    }
  }
}

[Danny Avila (danny-avila)]

Thanks 0x-fang! It wasn't immediately clear what the BedrockRuntimeClient expected to use an API Key defined at runtime.

In any case, we need a release for @langchain/aws or we need to override @aws-sdk/client-bedrock-runtime

[0x-fang]

Hi Danny Avila (@danny-avila) the above approach only works with bedrock-runtime-client Javascript SDK, but not boto3. If we're using @langchain/aws or @aws-sdk/client-bedrock-runtime, which internally rely on boto3, we'll need to set env variable to support API key during bedrock API call. The BedrockRuntimeClient in boto3 (e.g., client = boto3.client('bedrock-runtime')) does not accept API-Key as a parameter.

We had raised a PR to bump up the boto3 version in @langchain/aws to support the env variable for API key. langchain-ai/langchain-aws#536 Thanks

[Hunter Lovell (hntrl)]

Danny Avila (@danny-avila) we missed the release step, apologies! Just pushed out 0.1.12 off of main.

For the issue that got added to address an api key param, would people prefer initializing as 0x-fang described or through an implicit apiKey field in the constructor of ChatBedrockConverse?