What
Bearer token authentication for AWS Bedrock has been refactored to use the SDK's native apiKey parameter instead of manually setting skipAuth: true and injecting an Authorization header.
Details
- Previously, when using
AWS_BEARER_TOKEN_BEDROCK, Claude Code would setskipAuth: !0and manually addAuthorization: Bearer <token>to the request headers. This has been simplified to pass the token directly asapiKey, which is the SDK's standard mechanism. - When
CLAUDE_CODE_SKIP_BEDROCK_AUTHis enabled, the code now properly extracts and preserves any existingAuthorizationheader fromdefaultHeadersconfiguration. Previously, custom authorization headers indefaultHeaderscould be ignored in certain code paths. - The
skipAuthflag is now only set whenCLAUDE_CODE_SKIP_BEDROCK_AUTHis enabled and no bearer token is available (previously it was set whenever either the skip flag or a bearer token was present).
Evidence
Bedrock client construction refactored across three code paths (search for apiKey: Y.token, apiKey: process.env.AWS_BEARER_TOKEN_BEDROCK, and the new pq_ helper that extracts authorization headers)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agree
Fixed Bedrock requests failing with 403 "Authorization header is missing" when using AWS_BEARER_TOKEN_BEDROCK or…