Request
Please add a public way to select bearer API-key authentication or AWS SigV4 when constructing AnthropicBedrockMantle and AsyncAnthropicBedrockMantle.
Today the client chooses implicitly. If AWS_BEARER_TOKEN_BEDROCK or ANTHROPIC_AWS_API_KEY is present, it selects bearer authentication unless static AWS credentials or a profile were passed. That leaves no public way to force SigV4 while still using the refreshable default AWS credential chain (for example, ECS task roles, EC2 instance profiles, IRSA, or other botocore providers).
Passing resolved static credentials is not an equivalent workaround because it snapshots temporary credentials and can break credential rotation. skip_auth=True is also not equivalent because it disables authentication entirely.
A possible API would be:
AnthropicBedrockMantle(auth_mode="auto" | "api_key" | "sigv4")
auto preserves the current selection behavior.api_key requires and uses a bearer key.sigv4 ignores ambient bearer-key environment variables and uses the normal AWS credential chain.
It should behave consistently for sync and async clients and remain selected when using copy() / with_options().
Without a public switch, downstream integrations currently have to depend on the private _use_sigv4 attribute. This came up in langchain-aws issue langchain-ai/langchain-aws#1217 and PR langchain-ai/langchain-aws#1234.
Request
Please add a public way to select bearer API-key authentication or AWS SigV4 when constructing
AnthropicBedrockMantleandAsyncAnthropicBedrockMantle.Today the client chooses implicitly. If
AWS_BEARER_TOKEN_BEDROCKorANTHROPIC_AWS_API_KEYis present, it selects bearer authentication unless static AWS credentials or a profile were passed. That leaves no public way to force SigV4 while still using the refreshable default AWS credential chain (for example, ECS task roles, EC2 instance profiles, IRSA, or other botocore providers).Passing resolved static credentials is not an equivalent workaround because it snapshots temporary credentials and can break credential rotation.
skip_auth=Trueis also not equivalent because it disables authentication entirely.A possible API would be:
autopreserves the current selection behavior.api_keyrequires and uses a bearer key.sigv4ignores ambient bearer-key environment variables and uses the normal AWS credential chain.It should behave consistently for sync and async clients and remain selected when using
copy()/with_options().Without a public switch, downstream integrations currently have to depend on the private
_use_sigv4attribute. This came up in langchain-aws issue langchain-ai/langchain-aws#1217 and PR langchain-ai/langchain-aws#1234.