Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix btw: requireApiKey throws for aws-sdk auth mode (Bedrock) [2 pull requests, 1 comments, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#55571•Fetched 2026-04-08 01:37:50
View on GitHub
Comments
1
Participants
1
Timeline
4
Reactions
0
Author
bobsahur-robotbobsahur-robot
Participants
bobsahur-robotbobsahur-robot
Timeline (top)
subscribed ×2commented ×1cross-referenced ×1

`/btw` fails with `"No API key resolved for provider "amazon-bedrock" (auth mode: aws-sdk)."` when using Bedrock with `auth: aws-sdk`.

Root Cause

`btw.ts` line 265 calls `requireApiKey(apiKeyInfo, model.provider)` unconditionally. For `aws-sdk` auth mode, `resolveAwsSdkAuthInfo()` returns `{ mode: "aws-sdk", source: ... }` with no `apiKey` field — which is correct, since Bedrock uses IAM SigV4 credentials, not API keys.

The main embedded runner handles this correctly:

// pi-embedded-runner/run.ts:610
if (apiKeyInfo.mode !== "aws-sdk") {
  // ... use apiKey
}

// pi-embedded-runner/compact.ts:646  
if (apiKeyInfo.mode !== "aws-sdk") {
  // ... use apiKey
}

But `btw.ts` does not have this guard.

Fix Action

Fix

In `btw.ts`, guard the `requireApiKey` call:

const apiKey = apiKeyInfo.mode === "aws-sdk" ? "" : requireApiKey(apiKeyInfo, model.provider);

Or pass the auth info through to the Bedrock SDK directly (as the embedded runner does).

PR fix notes

PR #64218: fix(btw): allow aws-sdk auth for bedrock side questions

Description (problem / solution / changelog)

Summary

  • allow /btw to skip requireApiKey(...) when Bedrock resolves auth: aws-sdk without a static key
  • keep the existing API key guard for auth modes that still require a concrete key
  • add a Bedrock regression test that proves /btw forwards no apiKey in the aws-sdk path

Why

runBtwSideQuestion() currently resolves provider auth via getApiKeyForModel(...), then immediately calls requireApiKey(...) unconditionally. That breaks Bedrock setups that intentionally use IAM/AWS SDK credential resolution instead of a static API key, even though the main embedded runners already allow mode === "aws-sdk" without one.

This revives the good part of #53598 with the smallest possible patch. I kept the fix aligned with the existing runner behavior in compact.ts and run/auth-controller.ts, and avoided the broken import path introduced in #53730.

Scope

  • Fixes #53592
  • Fixes #55571
  • Supersedes #53598
  • The follow-up Bedrock toolConfig problem remains separately tracked in #56558

Verification

  • pnpm test src/agents/btw.test.ts
  • pnpm check

Changed files

  • CHANGELOG.md (modified, +1/-0)
  • src/agents/btw.test.ts (modified, +31/-0)
  • src/agents/btw.ts (modified, +4/-1)

PR #53730: Fix #53592: allow aws-sdk auth mode in /btw side question

Description (problem / solution / changelog)

Fix #53592: /btw fails with aws-sdk auth mode (Bedrock instance role)

Problem

/btw side questions fail when using Amazon Bedrock with auth: aws-sdk (EC2 instance role credentials), throwing:

No API key resolved for provider "amazon-bedrock" (auth mode: aws-sdk).

Root Cause

runBtwSideQuestion() unconditionally called requireApiKey(), which throws when no apiKey is present — without checking if the auth mode is aws-sdk, which is valid without a static key (AWS SDK resolves credentials from instance roles/env vars).

The main embedded runner (compact.ts, run.ts) already handles this correctly with a conditional check.

Fix

Replace requireApiKey() with the same conditional used in the main runner:

  • No apiKey + mode === "aws-sdk" → proceed (AWS SDK chain handles credentials)
  • No apiKey + mode !== "aws-sdk" → throw error
  • Has apiKey → proceed normally

File changed: src/agents/btw.ts — 1 file, ~11 lines added, 2 removed

Closes #53592

Changed files

  • src/agents/btw.ts (modified, +11/-2)

Code Example

// pi-embedded-runner/run.ts:610
if (apiKeyInfo.mode !== "aws-sdk") {
  // ... use apiKey
}

// pi-embedded-runner/compact.ts:646  
if (apiKeyInfo.mode !== "aws-sdk") {
  // ... use apiKey
}

---

const apiKey = apiKeyInfo.mode === "aws-sdk" ? "" : requireApiKey(apiKeyInfo, model.provider);
RAW_BUFFERClick to expand / collapse

Summary

`/btw` fails with `"No API key resolved for provider "amazon-bedrock" (auth mode: aws-sdk)."` when using Bedrock with `auth: aws-sdk`.

Root Cause

`btw.ts` line 265 calls `requireApiKey(apiKeyInfo, model.provider)` unconditionally. For `aws-sdk` auth mode, `resolveAwsSdkAuthInfo()` returns `{ mode: "aws-sdk", source: ... }` with no `apiKey` field — which is correct, since Bedrock uses IAM SigV4 credentials, not API keys.

The main embedded runner handles this correctly:

// pi-embedded-runner/run.ts:610
if (apiKeyInfo.mode !== "aws-sdk") {
  // ... use apiKey
}

// pi-embedded-runner/compact.ts:646  
if (apiKeyInfo.mode !== "aws-sdk") {
  // ... use apiKey
}

But `btw.ts` does not have this guard.

Fix

In `btw.ts`, guard the `requireApiKey` call:

const apiKey = apiKeyInfo.mode === "aws-sdk" ? "" : requireApiKey(apiKeyInfo, model.provider);

Or pass the auth info through to the Bedrock SDK directly (as the embedded runner does).

Environment

  • OpenClaw 2026.3.24 (dev build)
  • Provider: amazon-bedrock with `auth: aws-sdk`
  • AWS_PROFILE set in config `env` block
  • Main session works fine; only /btw fails

extent analysis

Fix Plan

To resolve the issue, we need to modify the btw.ts file to handle the aws-sdk auth mode correctly. Here are the steps:

  • Open the btw.ts file and locate the line where requireApiKey is called.
  • Add a conditional statement to check if the apiKeyInfo.mode is aws-sdk.
  • If it is, set the apiKey to an empty string or pass the auth info directly to the Bedrock SDK.

Example code:

const apiKey = apiKeyInfo.mode === "aws-sdk" ? "" : requireApiKey(apiKeyInfo, model.provider);

Alternatively, you can pass the auth info through to the Bedrock SDK directly:

if (apiKeyInfo.mode !== "aws-sdk") {
  const apiKey = requireApiKey(apiKeyInfo, model.provider);
  // use apiKey
} else {
  // pass auth info to Bedrock SDK
}

Verification

To verify that the fix worked, run the /btw command again and check if the error message is resolved. You can also test the main session to ensure it still works fine.

Extra Tips

  • Make sure to update the btw.ts file in the correct environment (OpenClaw 2026.3.24 dev build).
  • If you are using a version control system, commit the changes and test them in a staging environment before deploying to production.
  • Consider adding a test case to cover this scenario to prevent regressions in the future.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#output truncation#response parsing#generation error#database connection

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING