aws changedmanage-claude/wif-providers/aws
Nearest release: v2.1.302, published 12 hours after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+79added
Lines−37removed
From line
95
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits10to this page, all time
The whole hunk
from line 95, old and new numbered
/
from line 95
9595
9696### Acquire and use the token
9797
98Call `GetWebIdentityToken` with `https://api.anthropic.com` as the audience, then pass the result to the SDK's federation credentials. Because `identity_token_provider` (typescript, php: `identityTokenProvider`; csharp: `IdentityTokenProvider`; go: `option.WithFederationTokenProvider`; java: `federationTokenProvider`) takes a callable, the SDK re-invokes STS on each refresh.
98Call `GetWebIdentityToken` with `https://api.anthropic.com` as the audience, then pass the result to the SDK's federation credentials through `identity_token_provider` (typescript: `identityTokenProvider`; php: `identityProvider`; csharp: `IdentityTokenProvider`; go: `option.WithFederationTokenProvider`; java: `IdentityTokenConfig`). Except in Java (see the comment in that example), that option takes a token provider, so the SDK re-invokes STS on each refresh.
9999
100100<Note>
101101 `GetWebIdentityToken` is available only on regional STS endpoints. If you receive `'STS' object has no attribute 'get_web_identity_token'` or a similar error, pin your STS client to a region (for example, `boto3.client("sts", region_name="us-east-1")`) and ensure your AWS SDK is recent enough to include the API.
from line 263
263263 ```
264264
265265 ```java Java
266 StsClient sts = StsClient.builder().region(Region.US_EAST_1).build();
266 import com.anthropic.config.AuthenticationConfig;
267 import com.anthropic.config.AuthenticationType;
268 import com.anthropic.config.IdentityTokenConfig;
269 import com.anthropic.config.InMemoryProfileConfigProvider;
270 import com.anthropic.config.ProfileConfig;
271 // ...
272 import software.amazon.awssdk.regions.Region;
273 import software.amazon.awssdk.services.sts.StsClient;
274 import software.amazon.awssdk.services.sts.model.GetWebIdentityTokenRequest;
267275
268 IdentityTokenProvider getStsToken = () -> sts.getWebIdentityToken(
269 GetWebIdentityTokenRequest.builder()
270 .audience("https://api.anthropic.com")
271 .signingAlgorithm("RS256")
272 .durationSeconds(900)
273 .build())
274 .webIdentityToken();
276 void main() {
277 StsClient sts = StsClient.builder().region(Region.US_EAST_1).build();
275278
276 AnthropicClient client = AnthropicOkHttpClient.builder()
277 .federationTokenProvider(
278 getStsToken,
279 System.getenv("ANTHROPIC_FEDERATION_RULE_ID"),
280 System.getenv("ANTHROPIC_ORGANIZATION_ID"),
281 System.getenv("ANTHROPIC_SERVICE_ACCOUNT_ID"))
282 .build();
279 // The Java SDK takes the token itself or a file path, not a function; with
280 // source("value"), path(...) holds the token. The SDK sends that same token
281 // at every refresh of the Anthropic access token, which fails once it has
282 // expired or, if it has a jti claim, been used. For a longer-running
283 // process, pass source("file") and write a new token to the file before
284 // each refresh.
285 String stsToken = sts.getWebIdentityToken(
286 GetWebIdentityTokenRequest.builder()
287 .audience("https://api.anthropic.com")
288 .signingAlgorithm("RS256")
289 .durationSeconds(900)
290 .build())
291 .webIdentityToken();
283292
284 var message = client.messages().create(MessageCreateParams.builder()
285 .model(Model.CLAUDE_OPUS_5_5)
286 .maxTokens(1024)
287 .addUserMessage("Hello from AWS")
288 .build());
293 AnthropicClient client = AnthropicOkHttpClient.builder()
294 .configurationProvider(InMemoryProfileConfigProvider.of(ProfileConfig.builder()
295 .organizationId(System.getenv("ANTHROPIC_ORGANIZATION_ID"))
296 .workspaceId(System.getenv("ANTHROPIC_WORKSPACE_ID"))
297 .authentication(AuthenticationConfig.builder()
298 .type(AuthenticationType.OIDC_FEDERATION)
299 .federationRuleId(System.getenv("ANTHROPIC_FEDERATION_RULE_ID"))
300 .serviceAccountId(System.getenv("ANTHROPIC_SERVICE_ACCOUNT_ID"))
301 .identityToken(IdentityTokenConfig.builder()
302 .source("value")
303 .path(stsToken)
304 .build())
305 .build())
306 .build()))
307 .build();
289308
290 IO.println(message.content());
309 var message = client.messages().create(MessageCreateParams.builder()
310 .model(Model.CLAUDE_OPUS_5_5)
311 .maxTokens(1024)
312 .addUserMessage("Hello from AWS")
313 .build());
314
315 IO.println(message.content());
316 }
291317 ```
292318
293319 ```csharp C#
from line 384
358384
359385 ```php PHP
360386 use Anthropic\Client;
361 use Anthropic\Credentials\WorkloadIdentityCredentials;
387 use Anthropic\Lib\Credentials\CredentialResult;
388 use Anthropic\Lib\Credentials\IdentityTokenProvider;
389 use Anthropic\Lib\Credentials\TokenCache;
390 use Anthropic\Lib\Credentials\WorkloadIdentityCredentials;
362391 use Aws\Sts\StsClient;
363392
364393 $sts = new StsClient(['region' => 'us-east-1', 'version' => 'latest']);
365 $client = new Client(credentials: new WorkloadIdentityCredentials(
366 identityTokenProvider: fn() => $sts->getWebIdentityToken([
367 'Audience' => ['https://api.anthropic.com'],
368 'SigningAlgorithm' => 'RS256',
369 'DurationSeconds' => 900,
370 ])['WebIdentityToken'],
371 federationRuleId: getenv('ANTHROPIC_FEDERATION_RULE_ID'),
372 organizationId: getenv('ANTHROPIC_ORGANIZATION_ID'),
373 serviceAccountId: getenv('ANTHROPIC_SERVICE_ACCOUNT_ID'),
374 workspaceId: getenv('ANTHROPIC_WORKSPACE_ID') ?: null,
394
395 class StsIdentityToken implements IdentityTokenProvider
396 {
397 public function __construct(private StsClient $sts) {}
398
399 public function getIdentityToken(): string
400 {
401 return $this->sts->getWebIdentityToken([
402 'Audience' => ['https://api.anthropic.com'],
403 'SigningAlgorithm' => 'RS256',
404 'DurationSeconds' => 900,
405 ])['WebIdentityToken'];
406 }
407 }
408
409 $client = new Client(credentials: new CredentialResult(
410 provider: new TokenCache(new WorkloadIdentityCredentials(
411 identityProvider: new StsIdentityToken($sts),
412 federationRuleId: getenv('ANTHROPIC_FEDERATION_RULE_ID'),
413 organizationId: getenv('ANTHROPIC_ORGANIZATION_ID'),
414 serviceAccountId: getenv('ANTHROPIC_SERVICE_ACCOUNT_ID'),
415 workspaceId: getenv('ANTHROPIC_WORKSPACE_ID') ?: null,
416 )),
375417 ));
376418
377419 $message = $client->messages->create(
No line in this hunk matches that.