Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix Image tool fails with aws-sdk auth (Bedrock): 'No API key resolved' [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#75816•Fetched 2026-05-02 05:29:36
View on GitHub
Comments
1
Participants
2
Timeline
2
Reactions
2
Author
shipitstevenshipitsteven
Participants
clawsweeper[bot]clawsweeper[bot]shipitstevenshipitsteven
Timeline (top)
closed ×1commented ×1

The image tool fails when the only configured provider uses auth: "aws-sdk" (Amazon Bedrock). Enterprise users authenticating via IAM credentials do not have API keys — the aws-sdk auth mode uses SigV4 signing instead.

Error Message

No API key resolved for provider "amazon-bedrock" (auth mode: aws-sdk).

Root Cause

The image tool resolves auth via requireApiKey (model-auth-runtime-shared), which throws if no literal API key string is available. The main chat completion path has an allowMissingApiKeyModes escape hatch that permits keyless auth for modes like aws-sdk, but the image tool code path does not use this.

Relevant code:

  • dist/image-BekbXrJh.js line 4: imports requireApiKey (strict)
  • dist/simple-completion-runtime-C4i8m8Bg.js line 50: has hasMissingApiKeyAllowance (permissive) — used by main LLM path but not image tool

Fix Action

Workaround

Enterprise Bedrock users can send images inline in chat (which works through the main model path) but cannot use the dedicated image tool for analysis.

Code Example

No API key resolved for provider "amazon-bedrock" (auth mode: aws-sdk).
RAW_BUFFERClick to expand / collapse

Summary

The image tool fails when the only configured provider uses auth: "aws-sdk" (Amazon Bedrock). Enterprise users authenticating via IAM credentials do not have API keys — the aws-sdk auth mode uses SigV4 signing instead.

Error

No API key resolved for provider "amazon-bedrock" (auth mode: aws-sdk).

Root Cause

The image tool resolves auth via requireApiKey (model-auth-runtime-shared), which throws if no literal API key string is available. The main chat completion path has an allowMissingApiKeyModes escape hatch that permits keyless auth for modes like aws-sdk, but the image tool code path does not use this.

Relevant code:

  • dist/image-BekbXrJh.js line 4: imports requireApiKey (strict)
  • dist/simple-completion-runtime-C4i8m8Bg.js line 50: has hasMissingApiKeyAllowance (permissive) — used by main LLM path but not image tool

Expected Behavior

The image tool should respect aws-sdk auth mode the same way the main completion runtime does — allowing keyless authentication when IAM credentials are available.

Environment

  • OpenClaw 2026.4.15
  • Provider: Amazon Bedrock (us-west-2)
  • Model: us.anthropic.claude-opus-4-6-v1 (supports vision: input: ["text", "image"])
  • Auth: aws-sdk (IAM via ada credentials)

Workaround

Enterprise Bedrock users can send images inline in chat (which works through the main model path) but cannot use the dedicated image tool for analysis.

Impact

Affects all enterprise users on AWS Bedrock without direct API keys (common in Amazon internal deployments).

extent analysis

TL;DR

The image tool can be fixed by adding the allowMissingApiKeyModes escape hatch to its code path, similar to the main chat completion path, to permit keyless auth for aws-sdk mode.

Guidance

  • Review the requireApiKey function in model-auth-runtime-shared and consider adding a conditional check for aws-sdk auth mode to allow keyless authentication.
  • Compare the code paths of the main completion runtime and the image tool to identify the missing allowMissingApiKeyModes check in the latter.
  • Investigate modifying the image tool to use the hasMissingApiKeyAllowance function from simple-completion-runtime-C4i8m8Bg.js to enable keyless auth.
  • Verify that the aws-sdk auth mode is correctly configured and that IAM credentials are available for authentication.

Example

No code snippet is provided due to the complexity of the issue and the need for a thorough review of the codebase.

Notes

The fix may require modifications to the image tool code and potentially other dependent modules. It is essential to thoroughly test the changes to ensure that keyless authentication works correctly for aws-sdk mode.

Recommendation

Apply a workaround by modifying the image tool code to include the allowMissingApiKeyModes check, allowing keyless authentication for aws-sdk mode, as this is a targeted fix for the specific issue affecting enterprise users on AWS Bedrock.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#serialization error#model compatibility#GPU setup#container setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix Image tool fails with aws-sdk auth (Bedrock): 'No API key resolved' [1 comments, 2 participants]