GatewayCredentialProvider Class
Factory class for creating different Gateway Credential Providers.
Example
ts
const gateway = new agentcore.Gateway(this, "MyGateway", {
gatewayName: "my-gateway",
});
// Outbound auth: ApiKeyCredentialProvider + bindForGatewayApiKeyTarget, or ARNs from console/API
const apiKeyIdentityArn = "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/apikeycredentialprovider/my-apikey"
const apiKeySecretArn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-apikey-secret-abc123"
const opneapiSchema = agentcore.ApiSchema.fromLocalAsset(path.join(__dirname, "mySchema.yml"));
opneapiSchema.bind(this);
// Create a gateway target with OpenAPI Schema
const target = agentcore.GatewayTarget.forOpenApi(this, "MyTarget", {
gatewayTargetName: "my-api-target",
description: "Target for external API integration",
gateway: gateway, // Note: you need to pass the gateway reference
apiSchema: opneapiSchema,
credentialProviderConfigurations: [
agentcore.GatewayCredentialProvider.fromApiKeyIdentityArn({
providerArn: apiKeyIdentityArn,
secretArn: apiKeySecretArn
}),
],
});
Initializer
ts
new GatewayCredentialProvider()
python
GatewayCredentialProvider()
java
new GatewayCredentialProvider()
csharp
new GatewayCredentialProvider()
go
NewGatewayCredentialProvider()
Methods
fromApiKeyIdentity(provider: IApiKeyCredentialProvider, options?: FromApiKeyIdentityOptions): ICredentialProviderConfig@staticmethod def from_api_key_identity(provider: IApiKeyCredentialProvider, options: typing.Optional[FromApiKeyIdentityOptions] = None) -> ICredentialProviderConfigpublic static ICredentialProviderConfig fromApiKeyIdentity(IApiKeyCredentialProvider provider, FromApiKeyIdentityOptions options)public static ICredentialProviderConfig FromApiKeyIdentity(IApiKeyCredentialProvider provider, FromApiKeyIdentityOptions? options = null)func FromApiKeyIdentity(Provider IApiKeyCredentialProvider, Options FromApiKeyIdentityOptions) ICredentialProviderConfigstatic#Create an API key outbound auth configuration from a Token Vault {@link IApiKeyCredentialProvider} construct.
Prefer this over {@link GatewayCredentialProvider.fromApiKeyIdentityArn} when the provider is defined in CDK.
fromApiKeyIdentityArn(props: ApiKeyCredentialProviderOptions): ICredentialProviderConfig@staticmethod def from_api_key_identity_arn(props: ApiKeyCredentialProviderOptions) -> ICredentialProviderConfigpublic static ICredentialProviderConfig fromApiKeyIdentityArn(ApiKeyCredentialProviderOptions props)public static ICredentialProviderConfig FromApiKeyIdentityArn(ApiKeyCredentialProviderOptions props)func FromApiKeyIdentityArn(Props ApiKeyCredentialProviderOptions) ICredentialProviderConfigstatic#Create an API key credential provider from Identity ARN Use this method when you have the Identity ARN as a string.
1 parameter · returns
Parameters
propspropspropspropsProps— - The configuration properties for the API key credential provider.
Returns: ICredentialProviderConfig configured for API key authentication
fromIamRole(props?: GatewayIamRoleCredentialProviderProps): ICredentialProviderConfig@staticmethod def from_iam_role(props: typing.Optional[GatewayIamRoleCredentialProviderProps] = None) -> ICredentialProviderConfigpublic static ICredentialProviderConfig fromIamRole(GatewayIamRoleCredentialProviderProps props)public static ICredentialProviderConfig FromIamRole(GatewayIamRoleCredentialProviderProps? props = null)func FromIamRole(Props GatewayIamRoleCredentialProviderProps) ICredentialProviderConfigstatic#Create an IAM role credential provider.
notes
The gateway authenticates outbound requests using its own execution role (SigV4). Provide service and optionally region to explicitly choose the SigV4 signing service / region instead of relying on the gateway's inference from the target endpoint. Useful for cross-region calls and for targets where the service can't be inferred from the URL. Explicit service / region is only supported for MCP Server and OpenAPI targets; other target types must use the bare fromIamRole().
fromOauthIdentity(provider: IOAuth2CredentialProvider, options: FromOauthIdentityOptions): ICredentialProviderConfig@staticmethod def from_oauth_identity(provider: IOAuth2CredentialProvider, options: FromOauthIdentityOptions) -> ICredentialProviderConfigpublic static ICredentialProviderConfig fromOauthIdentity(IOAuth2CredentialProvider provider, FromOauthIdentityOptions options)public static ICredentialProviderConfig FromOauthIdentity(IOAuth2CredentialProvider provider, FromOauthIdentityOptions options)func FromOauthIdentity(Provider IOAuth2CredentialProvider, Options FromOauthIdentityOptions) ICredentialProviderConfigstatic#Create an OAuth outbound auth configuration from a Token Vault {@link IOAuth2CredentialProvider} construct.
Prefer this over {@link GatewayCredentialProvider.fromOauthIdentityArn} when the provider is defined in CDK.
fromOauthIdentityArn(props: OAuthConfiguration): ICredentialProviderConfig@staticmethod def from_oauth_identity_arn(props: OAuthConfiguration) -> ICredentialProviderConfigpublic static ICredentialProviderConfig fromOauthIdentityArn(OAuthConfiguration props)public static ICredentialProviderConfig FromOauthIdentityArn(OAuthConfiguration props)func FromOauthIdentityArn(Props OAuthConfiguration) ICredentialProviderConfigstatic#Create an OAuth credential provider from Identity ARN Use this method when you have the Identity ARN as a string.
1 parameter · returns
Parameters
propspropspropspropsProps— - The configuration properties for the OAuth credential provider.
Returns: ICredentialProviderConfig configured for OAuth authentication