---
title: Amazon Bedrock
description: Route Amazon Bedrock requests through AI Gateway for observability and control.
image: https://developers.cloudflare.com/dev-products-preview.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://developers.cloudflare.com/ai-gateway/llms.txt  
> Use this file to discover all available pages before exploring further.

[Skip to content](#%5Ftop) 

# Amazon Bedrock

[Amazon Bedrock ↗](https://aws.amazon.com/bedrock/) allows you to build and scale generative AI applications with foundation models.

## Endpoint

```

https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/aws-bedrock


```

## Prerequisites

When making requests to Amazon Bedrock, you will need:

* AI Gateway account ID
* AI Gateway gateway name
* AWS credentials (`accessKeyId`, `secretAccessKey`, and `region`) with permissions for Amazon Bedrock
* The name of the Amazon Bedrock model you want to use

## URL structure

When making requests to Amazon Bedrock, replace `https://bedrock-runtime.us-east-1.amazonaws.com/` in the URL you are currently using with `https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/aws-bedrock/bedrock-runtime/us-east-1/`, then append the model you want to use.

For example, to invoke the Anthropic Claude model in `us-east-1`:

```

https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/aws-bedrock/bedrock-runtime/us-east-1/model/us.anthropic.claude-haiku-4-5-20251001-v1:0/invoke


```

## Authenticating with Amazon Bedrock

Amazon Bedrock uses [AWS Signature Version 4 (SigV4) ↗](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference%5Faws-signing.html) to authenticate API requests. Unlike providers such as OpenAI or Anthropic that use a simple API key, AWS requires each request to be cryptographically signed with your credentials.

AI Gateway handles this complexity for you. When you store your AWS credentials using BYOK, the gateway automatically signs each request before forwarding it to AWS.

### Authentication methods comparison

| Method                  | cf-aig-authorization header | Authorization header   | Signing                            |
| ----------------------- | --------------------------- | ---------------------- | ---------------------------------- |
| **BYOK (Recommended)**  | Bearer {CF\_AIG\_TOKEN}     | Not needed             | Gateway signs automatically        |
| **Client-side signing** | Bearer {CF\_AIG\_TOKEN}     | Pre-signed AWS headers | You sign with aws4fetch or AWS SDK |

Do not confuse the headers

`cf-aig-authorization` authenticates your request to AI Gateway. When using BYOK, you do not need to include any AWS authorization headers because AI Gateway signs the request for you.

### Option 1: BYOK (Recommended)

The recommended approach is to store your AWS credentials using AI Gateway's [Bring Your Own Keys (BYOK)](https://developers.cloudflare.com/ai-gateway/configuration/bring-your-own-keys/) feature. This keeps your credentials secure and eliminates the need for client-side request signing.

1. In the Cloudflare dashboard, go to **AI** \> **AI Gateway** \> your gateway > **Provider Keys**.
2. Select **Add API Key** and choose **Amazon Bedrock** as the provider.
3. Enter your AWS credentials as a JSON object with the following structure:  
```  
{  
  "accessKeyId": "AKIAIOSFODNN7EXAMPLE",  
  "secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",  
  "region": "us-east-1"  
}  
```
4. Select **Save**.

If you are using temporary credentials from AWS STS (for example, from assuming an IAM role), include the `sessionToken` field:

```

{

  "accessKeyId": "ASIAIOSFODNN7EXAMPLE",

  "secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",

  "region": "us-east-1",

  "sessionToken": "FwoGZXIvYXdzEBY..."

}


```

With BYOK configured, you only need to include the `cf-aig-authorization` header in your requests. AI Gateway handles the AWS SigV4 signing automatically.

### Option 2: Client-side signing

If you prefer to sign requests yourself, you can use the [aws4fetch ↗](https://github.com/mhart/aws4fetch) library or any AWS SDK to sign the request before sending it through AI Gateway. Refer to the [client-side signing example](#client-side-signing-with-aws4fetch) below.

## Examples

### cURL with BYOK

With your AWS credentials [stored as a provider key](https://developers.cloudflare.com/ai-gateway/configuration/bring-your-own-keys/), requests are simple — no AWS signing required:

Terminal window

```

curl "https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/aws-bedrock/bedrock-runtime/us-east-1/model/us.anthropic.claude-haiku-4-5-20251001-v1:0/invoke" \

  -H "cf-aig-authorization: Bearer {CF_AIG_TOKEN}" \

  -H "Content-Type: application/json" \

  -d '{

    "messages": [

      {

        "role": "user",

        "content": "What is Cloudflare?"

      }

    ],

    "max_tokens": 256,

    "anthropic_version": "bedrock-2023-05-31"

  }'


```

### Client-side signing with aws4fetch

If you are not using BYOK, you must sign the request before sending it through AI Gateway. The following example uses the `aws4fetch` library in a Cloudflare Worker:

TypeScript

```

import { AwsClient } from "aws4fetch";


interface Env {

  accessKey: string;

  secretAccessKey: string;

}


export default {

  async fetch(

    request: Request,

    env: Env,

    ctx: ExecutionContext,

  ): Promise<Response> {

    const cfAccountId = "{account_id}";

    const gatewayName = "{gateway_id}";

    const region = "us-east-1";


    const awsClient = new AwsClient({

      accessKeyId: env.accessKey,

      secretAccessKey: env.secretAccessKey,

      region: region,

      service: "bedrock",

    });


    const body = JSON.stringify({

      messages: [{ role: "user", content: "What does ethereal mean?" }],

      max_tokens: 256,

      anthropic_version: "bedrock-2023-05-31",

    });


    // Sign against the original AWS URL

    const awsUrl = `https://bedrock-runtime.${region}.amazonaws.com/model/us.anthropic.claude-haiku-4-5-20251001-v1:0/invoke`;


    const presignedRequest = await awsClient.sign(awsUrl, {

      method: "POST",

      headers: { "Content-Type": "application/json" },

      body: body,

    });


    // Send through AI Gateway

    const gatewayUrl = `https://gateway.ai.cloudflare.com/v1/${cfAccountId}/${gatewayName}/aws-bedrock/bedrock-runtime/${region}/model/us.anthropic.claude-haiku-4-5-20251001-v1:0/invoke`;


    const response = await fetch(gatewayUrl, {

      method: "POST",

      headers: presignedRequest.headers,

      body: body,

    });


    if (

      response.ok &&

      response.headers.get("content-type")?.includes("application/json")

    ) {

      const data = await response.json();

      return new Response(JSON.stringify(data));

    }


    return new Response("Invalid response", { status: 500 });

  },

};


```

## Using the Unified API (OpenAI compatible)

AI Gateway provides a [Unified API](https://developers.cloudflare.com/ai-gateway/usage/chat-completion/) that lets you use the OpenAI chat completions format with Bedrock models. This is currently supported for **Anthropic Claude** and **Amazon Nova** model families. You can use the OpenAI SDK to access these models running on Bedrock without changing your request format.

### Endpoint

```

https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/compat/chat/completions


```

### cURL

With your AWS credentials [stored as a provider key](https://developers.cloudflare.com/ai-gateway/configuration/bring-your-own-keys/), specify the model using the `aws-bedrock/{model}` format:

Terminal window

```

curl "https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/compat/chat/completions" \

  -H "cf-aig-authorization: Bearer {CF_AIG_TOKEN}" \

  -H "Content-Type: application/json" \

  -d '{

    "model": "aws-bedrock/us.anthropic.claude-haiku-4-5-20251001-v1:0",

    "messages": [

      {

        "role": "user",

        "content": "What is Cloudflare?"

      }

    ]

  }'


```

### OpenAI SDK

JavaScript

```

import OpenAI from "openai";


const client = new OpenAI({

  apiKey: "{CF_AIG_TOKEN}",

  baseURL:

    "https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/compat",

});


const response = await client.chat.completions.create({

  model: "aws-bedrock/us.anthropic.claude-haiku-4-5-20251001-v1:0",

  messages: [

    {

      role: "user",

      content: "What is Cloudflare?",

    },

  ],

});


console.log(response.choices[0].message.content);


```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/ai-gateway/","name":"AI Gateway"}},{"@type":"ListItem","position":3,"item":{"@id":"/ai-gateway/usage/","name":"Using AI Gateway"}},{"@type":"ListItem","position":4,"item":{"@id":"/ai-gateway/usage/providers/","name":"Provider Native"}},{"@type":"ListItem","position":5,"item":{"@id":"/ai-gateway/usage/providers/bedrock/","name":"Amazon Bedrock"}}]}
```