aws changedmanage-claude/wif-providers/aws
Nearest release: v2.1.304, published under an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+29added
Lines−30removed
From line
110
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits10to this page, all time
The whole hunk
from line 110, old and new numbered
/
from line 110
110110 --duration-seconds 900 \
111111 --query WebIdentityToken --output text)
112112
113 RESPONSE=$(curl -sS https://api.anthropic.com/v1/oauth/token \
113 ACCESS_TOKEN=$(curl -sS https://api.anthropic.com/v1/oauth/token \
114114 -H "content-type: application/json" \
115 --data @- <<JSON
115 --data @- <<JSON | jq -r .access_token
116116 {
117117 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
118118 "assertion": "$JWT",
from line 124
124124 JSON
125125 )
126126
127 ACCESS_TOKEN=$(echo "$RESPONSE" | jq -r .access_token)
128
129127 curl https://api.anthropic.com/v1/messages \
130128 -H "authorization: Bearer $ACCESS_TOKEN" \
131129 -H "anthropic-version: 2023-06-01" \
from line 132
134132 "model": "claude-opus-5-5",
135133 "max_tokens": 1024,
136134 "messages": [{"role": "user", "content": "Hello from AWS"}]
137 }' | jq -r '.content[] | select(.type == "text") | .text'
135 }'
138136 ```
139137
140138 ```python Python
from line 363
365363 ```
366364
367365 ```bash CLI
368 TOKEN_FILE=$(mktemp)
366 export ANTHROPIC_IDENTITY_TOKEN_FILE=$(mktemp)
369367 aws sts get-web-identity-token \
370368 --region us-east-1 \
371369 --audience "https://api.anthropic.com" \
372370 --signing-algorithm RS256 \
373371 --duration-seconds 900 \
374 --query WebIdentityToken --output text > "$TOKEN_FILE"
372 --query WebIdentityToken --output text > "$ANTHROPIC_IDENTITY_TOKEN_FILE"
375373
376 export ANTHROPIC_IDENTITY_TOKEN_FILE="$TOKEN_FILE"
377374 # ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID, and
378375 # ANTHROPIC_SERVICE_ACCOUNT_ID, and ANTHROPIC_WORKSPACE_ID are read from the environment
379376 ant messages create \
from line 466
469466
470467curl -sS https://api.anthropic.com/v1/oauth/token \
471468 -H "content-type: application/json" \
472 -d "{
473 \"grant_type\": \"urn:ietf:params:oauth:grant-type:jwt-bearer\",
474 \"assertion\": \"$JWT\",
475 \"federation_rule_id\": \"fdrl_...\",
476 \"organization_id\": \"00000000-0000-0000-0000-000000000000\",
477 \"service_account_id\": \"svac_...\",
478 \"workspace_id\": \"wrkspc_...\"
479 }" | jq
469 --data @- <<JSON
470{
471 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
472 "assertion": "$JWT",
473 "federation_rule_id": "fdrl_...",
474 "organization_id": "00000000-0000-0000-0000-000000000000",
475 "service_account_id": "svac_...",
476 "workspace_id": "wrkspc_..."
477}
478JSON
480479```
481480
482481A successful exchange returns an `access_token` beginning with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange); the most common AWS-side cause is an `iss` mismatch (the per-account STS issuer URL must match the registered `issuer_url` exactly).
from line 616
617616 ```bash cURL
618617 JWT=$(cat "$ANTHROPIC_IDENTITY_TOKEN_FILE")
619618
620 RESPONSE=$(curl -sS https://api.anthropic.com/v1/oauth/token \
619 ACCESS_TOKEN=$(curl -sS https://api.anthropic.com/v1/oauth/token \
621620 -H "content-type: application/json" \
622 --data @- <<JSON
621 --data @- <<JSON | jq -r .access_token
623622 {
624623 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
625624 "assertion": "$JWT",
from line 630
631630 JSON
632631 )
633632
634 ACCESS_TOKEN=$(echo "$RESPONSE" | jq -r .access_token)
635
636633 curl https://api.anthropic.com/v1/messages \
637634 -H "authorization: Bearer $ACCESS_TOKEN" \
638635 -H "anthropic-version: 2023-06-01" \
from line 638
641638 "model": "claude-opus-5-5",
642639 "max_tokens": 1024,
643640 "messages": [{"role": "user", "content": "Hello from EKS"}]
644 }' | jq -r '.content[] | select(.type == "text") | .text'
641 }'
645642 ```
646643
647644 ```python Python
from line 821
824821
825822curl -sS https://api.anthropic.com/v1/oauth/token \
826823 -H "content-type: application/json" \
827 -d "{
828 \"grant_type\": \"urn:ietf:params:oauth:grant-type:jwt-bearer\",
829 \"assertion\": \"$JWT\",
830 \"federation_rule_id\": \"$ANTHROPIC_FEDERATION_RULE_ID\",
831 \"organization_id\": \"$ANTHROPIC_ORGANIZATION_ID\",
832 \"service_account_id\": \"$ANTHROPIC_SERVICE_ACCOUNT_ID\",
833 \"workspace_id\": \"$ANTHROPIC_WORKSPACE_ID\"
834 }" | jq
824 --data @- <<JSON
825{
826 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
827 "assertion": "$JWT",
828 "federation_rule_id": "$ANTHROPIC_FEDERATION_RULE_ID",
829 "organization_id": "$ANTHROPIC_ORGANIZATION_ID",
830 "service_account_id": "$ANTHROPIC_SERVICE_ACCOUNT_ID",
831 "workspace_id": "$ANTHROPIC_WORKSPACE_ID"
832}
833JSON
835834```
836835
837836A successful exchange returns an `access_token` beginning with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange); the most common EKS-side cause is the projected token's `aud` not matching the rule (project a token with `audience: https://api.anthropic.com`, not the IRSA default `sts.amazonaws.com`).
No line in this hunk matches that.