Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix [BUG] Claude Code hits error 403 when using AWS Bedrock API key [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#45000•Fetched 2026-04-09 08:15:44
View on GitHub
Comments
0
Participants
1
Timeline
6
Reactions
0
Author
CroxxNCroxxN
Participants
CroxxNCroxxN
Timeline (top)
labeled ×4closed ×1cross-referenced ×1

Error Message

Error Messages/Logs

API error (attempt 1/11): 403 403 {"Message":"Authorization header is missing"}

Code Example

403 {"Message":"Authorization header is missing"}

---

Authorization: Bearer <token>

---

[API:request] Creating client, ANTHROPIC_CUSTOM_HEADERS present: false, has Authorization header: false
[API REQUEST] /model/us.anthropic.claude-haiku-4-5-20251001-v1:0/invoke-with-response-stream source=sdk
API error (attempt 1/11): 403 403 {"Message":"Authorization header is missing"}

---

export CLAUDE_CODE_USE_BEDROCK=1
export AWS_BEARER_TOKEN_BEDROCK='<valid token>'

---

export CLAUDE_CODE_USE_BEDROCK=1
export AWS_BEARER_TOKEN_BEDROCK='<valid token>'

---

claude auth status --json

---

{
  "loggedIn": true,
  "authMethod": "third_party",
  "apiProvider": "bedrock"
}

---

if (this.skipAuth) {
  H.headers.delete("Authorization");
  return;
}
RAW_BUFFERClick to expand / collapse

Preflight Checklist

  • I have searched existing issues and this hasn't been reported yet
  • This is a single bug report (please file separate reports for different bugs)
  • I am using the latest version of Claude Code

What's Wrong?

Claude Code 2.1.94 fails against Amazon Bedrock when authentication is provided via AWS_BEARER_TOKEN_BEDROCK.

The request is sent to the correct Bedrock runtime endpoint, but the outgoing request does not include the Authorization: Bearer ... header. Bedrock then returns:

403 {"Message":"Authorization header is missing"}

What Should Happen?

When AWS_BEARER_TOKEN_BEDROCK is set, Claude Code should send:

Authorization: Bearer <token>

to the Bedrock runtime endpoint.

Error Messages/Logs

[API:request] Creating client, ANTHROPIC_CUSTOM_HEADERS present: false, has Authorization header: false
[API REQUEST] /model/us.anthropic.claude-haiku-4-5-20251001-v1:0/invoke-with-response-stream source=sdk
API error (attempt 1/11): 403 403 {"Message":"Authorization header is missing"}

Steps to Reproduce

export CLAUDE_CODE_USE_BEDROCK=1
export AWS_BEARER_TOKEN_BEDROCK='<valid token>'

Reproduction

1. Set relevant environment variables

export CLAUDE_CODE_USE_BEDROCK=1
export AWS_BEARER_TOKEN_BEDROCK='<valid token>'

2. Confirm Claude is using Bedrock

claude auth status --json

Observed result:

{
  "loggedIn": true,
  "authMethod": "third_party",
  "apiProvider": "bedrock"
}

2. Run Claude and send any prompt.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

No response

Claude Code Version

2.1.94

Platform

AWS Bedrock

Operating System

Other Linux

Terminal/Shell

Other

Additional Information

Static analysis of the 2.1.94 packed binary suggests the Bedrock bearer-token branch is internally inconsistent:

  1. In the Bedrock client factory, when AWS_BEARER_TOKEN_BEDROCK is present, Claude constructs the Bedrock client with both:

    • skipAuth: true
    • defaultHeaders.Authorization = Bearer <token>

  2. In the embedded AnthropicBedrock client, prepareRequest() contains logic equivalent to:

if (this.skipAuth) {
  H.headers.delete("Authorization");
  return;
}
  1. In the base client request flow, headers are built first and prepareRequest() runs after that.

The net effect is:

  • Claude adds the bearer token to headers
  • prepareRequest() then deletes Authorization
  • the request is sent without auth

extent analysis

TL;DR

The issue can likely be fixed by removing the skipAuth: true flag when AWS_BEARER_TOKEN_BEDROCK is present, allowing the Authorization header to be included in the request.

Guidance

  • Review the Bedrock client factory logic to ensure that skipAuth is set to false when AWS_BEARER_TOKEN_BEDROCK is provided.
  • Verify that the prepareRequest() method in the AnthropicBedrock client does not delete the Authorization header when skipAuth is false.
  • Check the request headers being sent to the Bedrock runtime endpoint to confirm that the Authorization: Bearer <token> header is included.
  • Consider updating the static analysis to identify similar inconsistencies in the codebase.

Example

// Bedrock client factory
if (AWS_BEARER_TOKEN_BEDROCK) {
  // Remove skipAuth: true
  defaultHeaders.Authorization = `Bearer ${AWS_BEARER_TOKEN_BEDROCK}`;
}

// AnthropicBedrock client
prepareRequest() {
  if (!this.skipAuth) {
    // Do not delete Authorization header
    return;
  }
  H.headers.delete("Authorization");
}

Notes

The provided static analysis suggests an internal inconsistency in the Bedrock bearer-token branch, which is likely the root cause of the issue. However, without access to the full codebase, it is difficult to provide a comprehensive solution.

Recommendation

Apply workaround: Remove the skipAuth: true flag when AWS_BEARER_TOKEN_BEDROCK is present, as this allows the Authorization header to be included in the request. This change should fix the issue, but it may not be the only solution, and further investigation may be necessary to ensure the correctness of the code.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#retriever error#indexing error#inference speed#environment variable

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING