When model.maxTokens is 0 (unset/unknown), omit maxTokens from the
Bedrock ConverseStream inferenceConfig instead of sending 0.
Bedrock's inferenceConfig.maxTokens is optional — when omitted, the
model uses its own internal default. This is optimal for Bedrock's
token quota management:
- At request start, Bedrock reserves input_tokens + max_tokens from
your TPM quota
- For Claude 3.7+ models, output tokens have a 5x burndown rate
- Sending an unnecessarily high maxTokens wastes TPM capacity during
the reservation window, reducing concurrent request throughput
- Omitting it lets Bedrock use the model default (~4096 for Claude),
matching expected output sizes and maximizing quota utilization
Also applies the same conditional pattern to temperature — only
include it in inferenceConfig when explicitly set.
Changes:
- simple-options.ts: Use ?? instead of || so explicit 0 is preserved;
return undefined when model.maxTokens is 0 (unset)
- amazon-bedrock.ts: Spread maxTokens and temperature into
inferenceConfig only when defined
Fixes#3399
BedrockRuntimeClient was constructed without the endpoint option,
causing model.baseUrl to be silently ignored. This meant custom
Bedrock endpoints (VPC endpoints, proxy setups, custom routing)
were never used — requests always went to the default regional
endpoint.
Pass model.baseUrl as the endpoint config when set. When not set
(the default), the SDK falls back to the standard regional endpoint
constructed from the region config, preserving existing behavior.
Fixesopenclaw/openclaw#47899
Adds bearer token authentication for the Bedrock Converse API, enabling
users to authenticate with an API key instead of SigV4/IAM credentials.
When a bearer token is available (via `options.bearerToken` or the
`AWS_BEARER_TOKEN_BEDROCK` env var), the provider:
1. Sets dummy credentials to prevent SDK credential resolution errors
2. Injects middleware after SigV4 signing that replaces the Authorization
header with `Bearer <token>` and removes SigV4-specific headers
This uses the official `bedrock:CallWithBearerToken` IAM action, which
is a documented AWS feature for API key auth on Bedrock endpoints.
Use case: users who receive a Bedrock API key (bearer token) from the
AWS console or their admin, without having IAM access keys or instance
roles. Similar to how ANTHROPIC_API_KEY works for direct Anthropic API.
Required IAM permission on the token's identity:
bedrock:CallWithBearerToken
Tested: Bearer token successfully authenticates against Bedrock Converse
API (returns correct 403 for missing IAM permission, not auth format error).
SigV4 path is unchanged when no bearer token is set.
wirjo