# GatewayCredentialProvider

Factory class for creating different Gateway Credential Providers.

- Source: [`aws-bedrockagentcore/lib/gateway/outbound-auth/credential-provider.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/gateway/outbound-auth/credential-provider.ts#L95)
- Type last changed: v2.262.0 · 22 Jul 2026

## Example

```ts

const gateway = new agentcore.Gateway(this, "MyGateway", {
  gatewayName: "my-gateway",
});

// Outbound auth: ApiKeyCredentialProvider + bindForGatewayApiKeyTarget, or ARNs from console/API
const apiKeyIdentityArn = "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/apikeycredentialprovider/my-apikey"
const apiKeySecretArn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-apikey-secret-abc123"

const opneapiSchema = agentcore.ApiSchema.fromLocalAsset(path.join(__dirname, "mySchema.yml"));
opneapiSchema.bind(this);

// Create a gateway target with OpenAPI Schema
const target = agentcore.GatewayTarget.forOpenApi(this, "MyTarget", {
  gatewayTargetName: "my-api-target",
  description: "Target for external API integration",
  gateway: gateway,  // Note: you need to pass the gateway reference
  apiSchema: opneapiSchema,
  credentialProviderConfigurations: [
    agentcore.GatewayCredentialProvider.fromApiKeyIdentityArn({
     providerArn: apiKeyIdentityArn,
     secretArn: apiKeySecretArn
    }),
  ],
});
```

## Initializer

```ts
new GatewayCredentialProvider()
```

## Methods

- `fromApiKeyIdentity(provider: IApiKeyCredentialProvider, options?: FromApiKeyIdentityOptions): ICredentialProviderConfig` (static) — Create an API key outbound auth configuration from a Token Vault {@link IApiKeyCredentialProvider} construct.

  Prefer this over {@link GatewayCredentialProvider.fromApiKeyIdentityArn} when the provider is defined in CDK.

- `fromApiKeyIdentityArn(props: ApiKeyCredentialProviderOptions): ICredentialProviderConfig` (static) — Create an API key credential provider from Identity ARN Use this method when you have the Identity ARN as a string.

  **Parameters**

  - `props` — - The configuration properties for the API key credential provider.

  **Returns:** ICredentialProviderConfig configured for API key authentication

- `fromIamRole(props?: GatewayIamRoleCredentialProviderProps): ICredentialProviderConfig` (static) — Create an IAM role credential provider.

  The gateway authenticates outbound requests using its own execution role (SigV4).
  Provide `service` and optionally `region` to explicitly choose the SigV4 signing
  service / region instead of relying on the gateway's inference from the target
  endpoint. Useful for cross-region calls and for targets where the service can't be
  inferred from the URL. Explicit `service` / `region` is only supported for MCP Server
  and OpenAPI targets; other target types must use the bare `fromIamRole()`.

- `fromOauthIdentity(provider: IOAuth2CredentialProvider, options: FromOauthIdentityOptions): ICredentialProviderConfig` (static) — Create an OAuth outbound auth configuration from a Token Vault {@link IOAuth2CredentialProvider} construct.

  Prefer this over {@link GatewayCredentialProvider.fromOauthIdentityArn} when the provider is defined in CDK.

- `fromOauthIdentityArn(props: OAuthConfiguration): ICredentialProviderConfig` (static) — Create an OAuth credential provider from Identity ARN Use this method when you have the Identity ARN as a string.

  **Parameters**

  - `props` — - The configuration properties for the OAuth credential provider.

  **Returns:** ICredentialProviderConfig configured for OAuth authentication