Unclear Where the credential lookup gets its values from, and so how you would supply one, is not clear.
What
When Claude Code runs through a cloud provider, it has to sign in to that provider. It now asks a credential lookup for each provider first, before using environment variables (settings passed to a program when it starts) or the default sign-in methods.
- The lookup applies to
bedrock,mantle,foundryandvertex. - If it finds a value, that value is used as the bearer token or API key, and the usual automatic sign-in is skipped.
- If it finds nothing, Claude Code falls back to the environment variables
AWS_BEARER_TOKEN_BEDROCKandANTHROPIC_FOUNDRY_API_KEY, as before. - For Amazon Bedrock, both ways of building the connection now check this token source first. A found token is sent with
httpBearerAuth. Otherwise, they fall back to sigv4 (AWS's request-signing method) or the AWS credential cache.
Why
Teams can now supply cloud provider credentials from a source other than environment variables or the standard AWS chain. The finding agents describe this as a vault-style credential store. If a credential is found there, it takes priority over the credentials you would otherwise sign in with.
Names in the bundleAWS_BEARER_TOKEN_BEDROCKANTHROPIC_FOUNDRY_API_KEY
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
Where the credential lookup gets its values from, and so how you would supply one, is not clear.