ApiKeyCredentialProviderOptions Struct
API key credential provider ARNs for gateway outbound auth (Token Vault identity).
Pass this to {@link GatewayCredentialProvider.fromApiKeyIdentityArn } or to {@link ApiKeyCredentialProviderConfiguration}.
Example
ts
const gateway = new agentcore.Gateway(this, "MyGateway", {
gatewayName: "my-gateway",
});
// ARNs from the console/API, or from ApiKeyCredentialProvider + bindForGatewayApiKeyTarget
const apiKeyProviderArn = "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/apikeycredentialprovider/my-apikey"
const apiKeySecretArn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-apikey-secret-abc123"
const bucket = s3.Bucket.fromBucketName(this, "ExistingBucket", "my-schema-bucket");
const s3mySchema = agentcore.ApiSchema.fromS3File(bucket, "schemas/myschema.yaml");
// Add an OpenAPI target using ARNs directly
const target = gateway.addOpenApiTarget("MyTarget", {
gatewayTargetName: "my-api-target",
description: "Target for external API integration",
apiSchema: s3mySchema,
credentialProviderConfigurations: [
agentcore.GatewayCredentialProvider.fromApiKeyIdentityArn({
providerArn: apiKeyProviderArn,
secretArn: apiKeySecretArn,
credentialLocation: agentcore.ApiKeyCredentialLocation.header({
credentialParameterName: "X-API-Key",
}),
}),
],
});
// This makes sure your s3 bucket is available before target
target.node.addDependency(bucket);
Properties
credentialLocationApiKeyCredentialLocationcredential_locationApiKeyCredentialLocationcredentialLocationApiKeyCredentialLocationCredentialLocationApiKeyCredentialLocationCredentialLocationApiKeyCredentialLocation= HEADER#The location of the API key credential.
This field specifies where in the request the API key should be placed.
The API key credential provider ARN.
This is returned when creating the API key credential provider via Console or API. Format: arn:aws:bedrock-agentcore:region:account:token-vault/id/apikeycredentialprovider/name
The ARN of the Secrets Manager secret containing the API key.
This is returned when creating the API key credential provider via Console or API. Format: arn:aws:secretsmanager:region:account㊙️name