# ApiKeyCredentialProviderOptions

API key credential provider ARNs for gateway outbound auth (Token Vault identity).

Pass this to {@link GatewayCredentialProvider.fromApiKeyIdentityArn } or to {@link ApiKeyCredentialProviderConfiguration}.

- Source: [`aws-bedrockagentcore/lib/gateway/outbound-auth/api-key.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/gateway/outbound-auth/api-key.ts#L103)
- Type last changed: v2.255.0 · 19 May 2026

## Example

```ts
const gateway = new agentcore.Gateway(this, "MyGateway", {
  gatewayName: "my-gateway",
});

// ARNs from the console/API, or from ApiKeyCredentialProvider + bindForGatewayApiKeyTarget
const apiKeyProviderArn = "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/apikeycredentialprovider/my-apikey"
const apiKeySecretArn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-apikey-secret-abc123"

const bucket = s3.Bucket.fromBucketName(this, "ExistingBucket", "my-schema-bucket");
const s3mySchema = agentcore.ApiSchema.fromS3File(bucket, "schemas/myschema.yaml");

// Add an OpenAPI target using ARNs directly
const target = gateway.addOpenApiTarget("MyTarget", {
  gatewayTargetName: "my-api-target",
  description: "Target for external API integration",
  apiSchema: s3mySchema,
  credentialProviderConfigurations: [
    agentcore.GatewayCredentialProvider.fromApiKeyIdentityArn({
      providerArn: apiKeyProviderArn,
      secretArn: apiKeySecretArn,
      credentialLocation: agentcore.ApiKeyCredentialLocation.header({
        credentialParameterName: "X-API-Key",
      }),
    }),
  ],
});

// This makes sure your s3 bucket is available before target
target.node.addDependency(bucket);
```

## Properties

- `credentialLocation`: [ApiKeyCredentialLocation](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.ApiKeyCredentialLocation.html) = HEADER — The location of the API key credential.

  This field specifies where in the request the API key should be placed.

- `providerArn`: string (required) — The API key credential provider ARN.

  This is returned when creating the API key credential provider via Console or API.
  Format: arn:aws:bedrock-agentcore:region:account:token-vault/id/apikeycredentialprovider/name

- `secretArn`: string (required) — The ARN of the Secrets Manager secret containing the API key.

  This is returned when creating the API key credential provider via Console or API.
  Format: arn:aws:secretsmanager:region:account:secret:name