### Preflight Checklist - [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet - [x] This is a single bug report (please file separate reports for different bugs) - [x] I am using the latest version of Claude Code ### What's Wrong? Bedrock bearer token authentication stopped working in 2.1.92. Every request returns `"403 {"Message":"Authorization header is missing"}"` from AWS Bedroc

[BUG] `AWS_BEARER_TOKEN_BEDROCK` auth broken in 2.1.92+ (regression from 2.1.91)

Status Fixed / completed

Reported on v2.1.92

Maintainer reply None cached

Activity 15 comments · opened Apr 7, 2026 · closed Apr 8, 2026

Preflight Checklist

[x] I have searched existing issues and this hasn't been reported yet
[x] This is a single bug report (please file separate reports for different bugs)
[x] I am using the latest version of Claude Code

What's Wrong?

Bedrock bearer token authentication stopped working in 2.1.92. Every request returns "403 {"Message":"Authorization header is missing"}" from AWS Bedrock. Downgrading to 2.1.91 fixes the issue immediately without any config changes.

What Should Happen?

Requests should authenticate via AWS_BEARER_TOKEN_BEDROCK set in ~/.claude/settings.json, as they did in 2.1.91.

Error Messages/Logs

Failed to authenticate. API Error: 403 {"Message":"Authorization header is missing"}
Retrying in 4 seconds… (attempt 5/10)

Steps to Reproduce

Configure ~/.claude/settings.json with CLAUDE_CODE_USE_BEDROCK=1 and a valid AWS_BEARER_TOKEN_BEDROCK
Run claude or claude -p "test"
Observe 403 {"Message":"Authorization header is missing"}

Notes:

The token is valid — aws bedrock list-foundation-models --region us-west-2 succeeds with the same token
Setting env vars explicitly before launching (CLAUDE_CODE_USE_BEDROCK=1 AWS_BEARER_TOKEN_BEDROCK=... claude -p "test") also fails
Downgrading to 2.1.91 fixes it: ln -sf ~/.local/share/claude/versions/2.1.91 ~/.local/bin/claude
Versions 2.1.92 and 2.1.94 both fail
macOS Darwin 25.2.0, native install

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.91

Claude Code Version

2.1.94

Platform

AWS Bedrock

Operating System

macOS

Terminal/Shell

Warp

Additional Information

Auth is configured entirely via ~/.claude/settings.json env block — no oauthAccount or primaryApiKey in ~/.claude.json. The settings.json env injection appears to work, but the Bedrock client constructor reads process.env before the injection runs, so the token is missing at request time.

Relevant settings.json structure:

{
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "AWS_BEARER_TOKEN_BEDROCK": "<token>",
    "ANTHROPIC_BEDROCK_BASE_URL": "https://bedrock-runtime.us-west-2.amazonaws.com/",
    "ANTHROPIC_MODEL": "us.anthropic.claude-sonnet-4-6",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "us.anthropic.claude-sonnet-4-6"
  }
}

View original on GitHub ↗

15 Comments

fcsouza · 4 months ago

i started receive this error in 2.1.94

github-actions[bot] · 4 months ago

Found 1 possible duplicate issue:

https://github.com/anthropics/claude-code/issues/36161

This issue will be automatically closed as a duplicate in 3 days.

If your issue is a duplicate, please close it and 👍 the existing issue instead
To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

schuyler-sousa-ai · 4 months ago

We're also seeing this issue on 2.1.94 (2.1.92 seems okay on our end, though)

CrazyKevinHu · 4 months ago

2.1.92 works fine on my end as well until this 94 comes out.....

CrazyKevinHu · 4 months ago

 403 Authorization header requires 'Credential' parameter. Authorization header requires 'Signature' parameter. Authorization
header requires 'SignedHeaders' parameter. (Hashed with SHA-256 and encoded with Base64) 
 Authorization=

muylucir · 4 months ago

Even after updating to version 2.1.94 and then downgrading back to the previous version, the same issue still persists.

awood45 · 4 months ago

Presents slightly differently for me but I can confirm 2.1.92 appears unaffected and 2.1.94 is impacted.

georgebashi · 4 months ago

We were using ANTHROPIC_AUTH_TOKEN, CLAUDE_CODE_SKIP_BEDROCK_AUTH and ANTHROPIC_BEDROCK_BASE_URL to proxy all our employees traffic via LiteLLM to Bedrock, and the 2.1.94 upgrade broke with a similar error. I checked via mitmproxy and the Authorization header is missing from 2.1.94 requests but was sent on 2.1.92.

We changed to setting ANTHROPIC_BASE_URL to use LiteLLM's Anthropic-compatible endpoint, and set CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS, and the combination of both fixed it for us. We also had one 2.1.94 install which didn't need CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS to work, so there may be a bad A/B test going on.

notitatall · 4 months ago

Thanks for the reports, friends! We're aware of an issue with the latest release (2.1.94). We are investigating and working on a fix now. Apologies for the disruption

w3soul · 4 months ago

Same issue here on v2.1.94, regressed from v2.1.91. My setup uses AWS_BEARER_TOKEN_BEDROCK with a custom enterprise Bedrock proxy via ANTHROPIC_BEDROCK_BASE_URL (not the standard AWS Bedrock endpoint).

The symptom differs slightly — I get 401 "api-key header is missing" instead of 403, because the proxy rejects token-less requests differently — but the root cause is the same: the bearer token from settings.json env is missing at request time, causing fallback to direct Anthropic API auth.

{
  "env":
    {"ANTHROPIC_BEDROCK_BASE_URL": "https://<enterprise-proxy-host>",
      "AWS_BEARER_TOKEN_BEDROCK": "<redacted>",
      "CLAUDE_CODE_USE_BEDROCK": "1",
      "ANTHROPIC_MODEL": "claude-sonnet-4.6"
    }
}

w3soul · 4 months ago

Why is this closed? the issue isn't resolved yet?

sarthchawla · 4 months ago

seems like a bug in v2.1.94 with aws bedrock
Steps to downgrade to 2.1.92:

disable auto upgrades in claude settings.json
{
"env": {
"DISABLE_AUTOUPDATER": "1"
}
}or use bash -> export DISABLE_AUTOUPDATER=1

depending upon your installer force version to 2.1.92

curl -fsSL https://claude.ai/install.sh | bash -s 2.1.92
& ([scriptblock]::Create((irm https://claude.ai/install.ps1))) 2.1.92
claude install 2.1.92 -> i used this and found this to be best since it lets claude cli handle the downgrading

notitatall · 4 months ago

Sorry for the premature close there. Though this issue should now _actually_ be resolved in the latest version: 2.1.96.

Run claude update (native install) or npm i -g @anthropic-ai/claude-code@latest to get the fix.

Thank you all for your detailed reports. Please open a new issue if you experience any more troubles.

aws-zhehongb · 4 months ago

We're seeing a related but distinct issue with SigV4 auth (OIDC role assumption) in claude-code-action using use_bedrock: true.

Working: 2.1.92 (agent-sdk 0.2.92)
Broken: 2.1.94 (agent-sdk 0.2.94) and 2.1.96 (agent-sdk 0.2.96)

The error is different from the bearer token case — the Authorization header is present, but it's a raw base64 string instead of proper SigV4 credentials:

403 Authorization header requires 'Credential' parameter.
Authorization header requires 'Signature' parameter.
Authorization header requires 'SignedHeaders' parameter.
(Hashed with SHA-256 and encoded with Base64) Authorization=<redacted>

So 2.1.96 may have fixed bearer token auth but the SigV4 path is still broken.