fix: support Bedrock API key login

packages/ai/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+### Fixed
+
+- Fixed Amazon Bedrock requests to use the generic `apiKey` stream option as a Bedrock bearer token.
+
 ## [0.80.6] - 2026-07-09
 
 ### Added

packages/ai/src/api/bedrock-converse-stream.ts

@@ -152,7 +152,10 @@ export const stream: StreamFunction<"bedrock-converse-stream", BedrockOptions> =
 		// Resolve bearer token for Bedrock API key auth.
 		const skipAuth = getProviderEnvValue("AWS_BEDROCK_SKIP_AUTH", options.env) === "1";
 		const bearerToken =
-			options.bearerToken || getProviderEnvValue("AWS_BEARER_TOKEN_BEDROCK", options.env) || undefined;
+			options.bearerToken ||
+			options.apiKey ||
+			getProviderEnvValue("AWS_BEARER_TOKEN_BEDROCK", options.env) ||
+			undefined;
 		const useBearerToken = bearerToken !== undefined && !skipAuth;
 
 		// in Node.js/Bun environment only

packages/ai/src/providers/amazon-bedrock.ts

@@ -9,7 +9,11 @@ import { AMAZON_BEDROCK_MODELS } from "./amazon-bedrock.models.ts";
  * configured. A stored credential key is surfaced as the bearer token.
  */
 const bedrockAuth: ApiKeyAuth = {
-	name: "AWS credentials",
+	name: "Bedrock API key or AWS credentials",
+	login: async (callbacks) => ({
+		type: "api_key",
+		key: await callbacks.prompt({ type: "secret", message: "Enter Bedrock API key" }),
+	}),
 	resolve: async ({ ctx, credential }) => {
 		if (credential?.key) return { auth: { apiKey: credential.key }, source: "stored credential" };
 		if (await ctx.env("AWS_BEARER_TOKEN_BEDROCK")) return { auth: {}, source: "AWS_BEARER_TOKEN_BEDROCK" };

packages/ai/test/bedrock-endpoint-resolution.test.ts

@@ -181,4 +181,13 @@ describe("bedrock endpoint resolution", () => {
 
 		expect(config.region).toBe("us-gov-west-1");
 	});
+
+	it("uses the generic API key option as a Bedrock bearer token", async () => {
+		const model = getModel("amazon-bedrock", "us.anthropic.claude-opus-4-8");
+
+		const config = await captureClientConfig(model, { apiKey: "bedrock-api-key" });
+
+		expect(config.token).toEqual({ token: "bedrock-api-key" });
+		expect(config.authSchemePreference).toEqual(["httpBearerAuth"]);
+	});
 });

packages/ai/test/providers.test.ts

@@ -54,6 +54,19 @@ describe("builtin providers", () => {
 		expect(result?.source).toBe("ANTHROPIC_OAUTH_TOKEN");
 	});
 
+	it("prompts for and stores a Bedrock API key", async () => {
+		const provider = amazonBedrockProvider();
+		const credential = await provider.auth.apiKey?.login?.({
+			prompt: async (prompt) => {
+				expect(prompt).toEqual({ type: "secret", message: "Enter Bedrock API key" });
+				return "bedrock-api-key";
+			},
+			notify: () => {},
+		});
+
+		expect(credential).toEqual({ type: "api_key", key: "bedrock-api-key" });
+	});
+
 	it("reports bedrock as configured from ambient AWS credentials without an api key", async () => {
 		const models = createModels({ authContext: fakeAuthContext({ AWS_PROFILE: "dev" }) });
 		models.setProvider(amazonBedrockProvider());