Skip to content

Amazon Bedrock

Last updated View as MarkdownAgent setup

Amazon Bedrock ↗︎ allows you to build and scale generative AI applications with foundation models.

Endpoint

https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/aws-bedrock

Prerequisites

When making requests to Amazon Bedrock, you will need:

  • AI Gateway account ID
  • AI Gateway gateway name
  • AWS credentials (accessKeyId, secretAccessKey, and region) with permissions for Amazon Bedrock
  • The name of the Amazon Bedrock model you want to use

URL structure

When making requests to Amazon Bedrock, replace https://bedrock-runtime.us-east-1.amazonaws.com/ in the URL you are currently using with https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/aws-bedrock/bedrock-runtime/us-east-1/, then append the model you want to use.

For example, to invoke the Anthropic Claude model in us-east-1:

https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/aws-bedrock/bedrock-runtime/us-east-1/model/us.anthropic.claude-haiku-4-5-20251001-v1:0/invoke

Authenticating with Amazon Bedrock

Amazon Bedrock uses AWS Signature Version 4 (SigV4) ↗︎ to authenticate API requests. Unlike providers such as OpenAI or Anthropic that use a simple API key, AWS requires each request to be cryptographically signed with your credentials.

AI Gateway handles this complexity for you. When you store your AWS credentials using BYOK, the gateway automatically signs each request before forwarding it to AWS.

Authentication methods comparison

Method cf-aig-authorization header Authorization header Signing
BYOK (Recommended) Bearer {CF_AIG_TOKEN} Not needed Gateway signs automatically
Client-side signing Bearer {CF_AIG_TOKEN} Pre-signed AWS headers You sign with aws4fetch or AWS SDK

The recommended approach is to store your AWS credentials using AI Gateway's Bring Your Own Keys (BYOK) feature. This keeps your credentials secure and eliminates the need for client-side request signing.

  1. In the Cloudflare dashboard, go to AI > AI Gateway > your gateway > Provider Keys.

  2. Select Add API Key and choose Amazon Bedrock as the provider.

  3. Enter your AWS credentials as a JSON object with the following structure:

    {
	"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
	"secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
	"region": "us-east-1"
}

  4. Select Save.

If you are using temporary credentials from AWS STS (for example, from assuming an IAM role), include the sessionToken field:

{
	"accessKeyId": "ASIAIOSFODNN7EXAMPLE",
	"secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
	"region": "us-east-1",
	"sessionToken": "FwoGZXIvYXdzEBY..."
}

With BYOK configured, you only need to include the cf-aig-authorization header in your requests. AI Gateway handles the AWS SigV4 signing automatically.

Option 2: Client-side signing

If you prefer to sign requests yourself, you can use the aws4fetch ↗︎ library or any AWS SDK to sign the request before sending it through AI Gateway. Refer to the client-side signing example below.

Examples

cURL with BYOK

With your AWS credentials stored as a provider key, requests are simple — no AWS signing required:

curl "https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/aws-bedrock/bedrock-runtime/us-east-1/model/us.anthropic.claude-haiku-4-5-20251001-v1:0/invoke" \
  -H "cf-aig-authorization: Bearer {CF_AIG_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "messages": [
      {
        "role": "user",
        "content": "What is Cloudflare?"
      }
    ],
    "max_tokens": 256,
    "anthropic_version": "bedrock-2023-05-31"
  }'

Client-side signing with aws4fetch

If you are not using BYOK, you must sign the request before sending it through AI Gateway. The following example uses the aws4fetch library in a Cloudflare Worker:

import { AwsClient } from "aws4fetch";

interface Env {
	accessKey: string;
	secretAccessKey: string;
}

export default {
	async fetch(
		request: Request,
		env: Env,
		ctx: ExecutionContext,
	): Promise<Response> {
		const cfAccountId = "{account_id}";
		const gatewayName = "{gateway_id}";
		const region = "us-east-1";

		const awsClient = new AwsClient({
			accessKeyId: env.accessKey,
			secretAccessKey: env.secretAccessKey,
			region: region,
			service: "bedrock",
		});

		const body = JSON.stringify({
			messages: [{ role: "user", content: "What does ethereal mean?" }],
			max_tokens: 256,
			anthropic_version: "bedrock-2023-05-31",
		});

		// Sign against the original AWS URL
		const awsUrl = `https://bedrock-runtime.${region}.amazonaws.com/model/us.anthropic.claude-haiku-4-5-20251001-v1:0/invoke`;

		const presignedRequest = await awsClient.sign(awsUrl, {
			method: "POST",
			headers: { "Content-Type": "application/json" },
			body: body,
		});

		// Send through AI Gateway
		const gatewayUrl = `https://gateway.ai.cloudflare.com/v1/${cfAccountId}/${gatewayName}/aws-bedrock/bedrock-runtime/${region}/model/us.anthropic.claude-haiku-4-5-20251001-v1:0/invoke`;

		const response = await fetch(gatewayUrl, {
			method: "POST",
			headers: presignedRequest.headers,
			body: body,
		});

		if (
			response.ok &&
			response.headers.get("content-type")?.includes("application/json")
		) {
			const data = await response.json();
			return new Response(JSON.stringify(data));
		}

		return new Response("Invalid response", { status: 500 });
	},
};

Use the Anthropic Messages API

Amazon Bedrock provides an Anthropic-native Messages API through the bedrock-mantle endpoint ↗︎. AI Gateway passes native Anthropic requests, responses, and server-sent events through without translation.

Configure native Anthropic clients with this base URL:

https://gateway.ai.cloudflare.com/v1/<ACCOUNT_ID>/<GATEWAY_ID>/aws-bedrock/bedrock-mantle/<AWS_REGION>/anthropic

The client appends /v1/messages to the base URL. Choose an AWS Region that supports the bedrock-mantle endpoint ↗︎, and use a model ID with the anthropic. prefix, such as anthropic.claude-opus-5.

If you use stored AWS credentials, the associated AWS Identity and Access Management (IAM) policy must allow the bedrock-mantle:CreateInference action. AI Gateway signs each request for the bedrock-mantle service.

The following examples call the Messages API with stored AWS credentials or an Amazon Bedrock API key:

Set $ACCOUNT_ID, $GATEWAY_ID, $AWS_REGION, and $CF_AIG_TOKEN before running an example. For the API key example, also set $BEDROCK_API_KEY to an Amazon Bedrock API key ↗︎.

curl "https://gateway.ai.cloudflare.com/v1/$ACCOUNT_ID/$GATEWAY_ID/aws-bedrock/bedrock-mantle/$AWS_REGION/anthropic/v1/messages" \
  --header "cf-aig-authorization: Bearer $CF_AIG_TOKEN" \
  --header "anthropic-version: 2023-06-01" \
  --header "Content-Type: application/json" \
  --data '{
    "model": "anthropic.claude-opus-5",
    "max_tokens": 256,
    "messages": [
      {
        "role": "user",
        "content": "What is Cloudflare?"
      }
    ]
  }'
curl "https://gateway.ai.cloudflare.com/v1/$ACCOUNT_ID/$GATEWAY_ID/aws-bedrock/bedrock-mantle/$AWS_REGION/anthropic/v1/messages" \
  --header "Authorization: Bearer $BEDROCK_API_KEY" \
  --header "cf-aig-authorization: Bearer $CF_AIG_TOKEN" \
  --header "anthropic-version: 2023-06-01" \
  --header "Content-Type: application/json" \
  --data '{
    "model": "anthropic.claude-opus-5",
    "max_tokens": 256,
    "messages": [
      {
        "role": "user",
        "content": "What is Cloudflare?"
      }
    ]
  }'

AI Gateway maps the bearer token to the x-api-key header that Bedrock Mantle expects.

Using the Unified API (OpenAI compatible)

AI Gateway provides a Unified API that lets you use the OpenAI chat completions format with Bedrock models. This is currently supported for Anthropic Claude and Amazon Nova model families. You can use the OpenAI SDK to access these models running on Bedrock without changing your request format.

When you authenticate to Amazon Bedrock with an API key, the Unified API sends requests to us-east-1. When you authenticate with AWS Signature Version 4 (SigV4), it uses the region selected in your stored AWS credentials instead.

Endpoint

https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/compat/chat/completions

cURL

With your AWS credentials stored as a provider key, specify the model using the aws-bedrock/{model} format:

curl "https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/compat/chat/completions" \
  -H "cf-aig-authorization: Bearer {CF_AIG_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "aws-bedrock/us.anthropic.claude-haiku-4-5-20251001-v1:0",
    "messages": [
      {
        "role": "user",
        "content": "What is Cloudflare?"
      }
    ]
  }'

OpenAI SDK

import OpenAI from "openai";

const client = new OpenAI({
	apiKey: "{CF_AIG_TOKEN}",
	baseURL:
		"https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/compat",
});

const response = await client.chat.completions.create({
	model: "aws-bedrock/us.anthropic.claude-haiku-4-5-20251001-v1:0",
	messages: [
		{
			role: "user",
			content: "What is Cloudflare?",
		},
	],
});

console.log(response.choices[0].message.content);

Was this helpful?