feat: prefer AWS-native auth naming (#5939)

# What does this PR do?

Rename Bedrock provider config fields from generic names (`api_key`,
`aws_bearer_token_bedrock`) to AWS-native names
(`aws_bedrock_bearer_token`) so the OpenAI-compatible Bedrock path reads
like an AWS credential-chain integration by default. Legacy field names
are preserved through Pydantic `AliasChoices` for backward
compatibility.

Related: #4730, #5388

Files changed:
- `config.py` -- rename `auth_credential` alias to
`aws_bedrock_bearer_token` with
`AliasChoices("aws_bedrock_bearer_token", "api_key")` for backward
compat
- `config.py` (BedrockProviderDataValidator) -- add
`AliasChoices("aws_bedrock_bearer_token", "aws_bearer_token_bedrock")`
for provider-data headers
- `bedrock.py` -- update `provider_data_api_key_field` and
`_should_use_sigv4()` to use the new field name
- `registry/inference.py` -- update provider description text
- `ci-tests/config.yaml`, `ci-tests/run-with-postgres-store.yaml`,
`starter/config.yaml`, `starter/run-with-postgres-store.yaml` -- rename
field and env var to `aws_bedrock_bearer_token` /
`AWS_BEDROCK_BEARER_TOKEN`
- `remote_bedrock.mdx` -- updated provider documentation
- `test_sigv4_auth.py`, `test_bedrock_adapter.py`,
`test_bedrock_config.py` -- updated to use new field names, added legacy
alias tests

## Test Plan

Unit tests covering new canonical names and legacy aliases (43 passed):

~~~bash
uv run pytest tests/unit/providers/inference/bedrock/test_sigv4_auth.py
\
  tests/unit/providers/inference/test_bedrock_adapter.py \
  tests/unit/providers/inference/test_bedrock_config.py -q
~~~

Live Bedrock smoke tests against a local OGX server in `us-east-2` with
SigV4 fallback and tested below successfully: `/v1/models` discovery,
OpenAI client non-streaming and streaming, empty/whitespace/null bearer
override fallback to SigV4 (both `aws_bedrock_bearer_token` and legacy
`aws_bearer_token_bedrock`), invalid bearer rejection with token-leak
check, valid bearer override with a real short-lived token (both keys),
concurrent request auth isolation mixing SigV4 and bearer paths,
repeated request smoke.



<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/ogx-ai/ogx/pull/5939"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open in Devin Review">
  </picture>
</a>
<!-- devin-review-badge-end -->

Signed-off-by: skamenan7 <skamenan@redhat.com>

Author: skamenan7

docs/docs/providers/inference/remote_bedrock.mdx

@@ -1,5 +1,5 @@
 ---
-description: "AWS Bedrock inference provider using OpenAI compatible endpoint."
+description: "AWS Bedrock inference provider for the OpenAI-compatible runtime, with AWS credential-chain auth by default and an optional bearer-token override."
 sidebar_label: Remote - Bedrock
 title: remote::bedrock
 ---
@@ -8,15 +8,15 @@ title: remote::bedrock
 
 ## Description
 
-AWS Bedrock inference provider using OpenAI compatible endpoint.
+AWS Bedrock inference provider for the OpenAI-compatible runtime, with AWS credential-chain auth by default and an optional bearer-token override.
 
 ## Configuration
 
 | Field | Type | Required | Default | Description |
 |-------|------|----------|---------|-------------|
 | `allowed_models` | `list[str] \| None` | No |  | List of models that should be registered with the model registry. If None, all models are allowed. |
 | `refresh_models` | `bool` | No | False | Whether to refresh models periodically from the provider |
-| `api_key` | `SecretStr \| None` | No |  | Authentication credential for the provider |
+| `aws_bedrock_bearer_token` | `SecretStr \| None` | No |  | Optional bearer token for Amazon Bedrock's OpenAI-compatible runtime. Leave unset to use the server's AWS credential chain (recommended). |
 | `network` | `NetworkConfig \| None` | No |  | Network configuration including TLS, proxy, and timeout settings. |
 | `network.tls` | `TLSConfig \| None` | No |  | TLS/SSL configuration for secure connections. |
 | `network.tls.verify` | `bool \| Path` | No | True | Whether to verify TLS certificates. Can be a boolean or a path to a CA certificate file. |
@@ -51,7 +51,7 @@ AWS Bedrock inference provider using OpenAI compatible endpoint.
 ## Sample Configuration
 
 ```yaml
-api_key: ${env.AWS_BEARER_TOKEN_BEDROCK:=}
+aws_bedrock_bearer_token: ${env.AWS_BEDROCK_BEARER_TOKEN:=}
 region_name: ${env.AWS_DEFAULT_REGION:=us-east-2}
 aws_role_arn: ${env.AWS_ROLE_ARN:=}
 aws_web_identity_token_file: ${env.AWS_WEB_IDENTITY_TOKEN_FILE:=}

src/ogx/distributions/ci-tests/config.yaml

@@ -43,7 +43,7 @@ providers:
   - provider_id: bedrock
     provider_type: remote::bedrock
     config:
-      api_key: ${env.AWS_BEARER_TOKEN_BEDROCK:=}
+      aws_bedrock_bearer_token: ${env.AWS_BEDROCK_BEARER_TOKEN:=}
       region_name: ${env.AWS_DEFAULT_REGION:=us-east-2}
       aws_role_arn: ${env.AWS_ROLE_ARN:=}
       aws_web_identity_token_file: ${env.AWS_WEB_IDENTITY_TOKEN_FILE:=}

src/ogx/distributions/ci-tests/run-with-postgres-store.yaml

@@ -43,7 +43,7 @@ providers:
   - provider_id: bedrock
     provider_type: remote::bedrock
     config:
-      api_key: ${env.AWS_BEARER_TOKEN_BEDROCK:=}
+      aws_bedrock_bearer_token: ${env.AWS_BEDROCK_BEARER_TOKEN:=}
       region_name: ${env.AWS_DEFAULT_REGION:=us-east-2}
       aws_role_arn: ${env.AWS_ROLE_ARN:=}
       aws_web_identity_token_file: ${env.AWS_WEB_IDENTITY_TOKEN_FILE:=}

src/ogx/distributions/starter/config.yaml

@@ -43,7 +43,7 @@ providers:
   - provider_id: bedrock
     provider_type: remote::bedrock
     config:
-      api_key: ${env.AWS_BEARER_TOKEN_BEDROCK:=}
+      aws_bedrock_bearer_token: ${env.AWS_BEDROCK_BEARER_TOKEN:=}
       region_name: ${env.AWS_DEFAULT_REGION:=us-east-2}
       aws_role_arn: ${env.AWS_ROLE_ARN:=}
       aws_web_identity_token_file: ${env.AWS_WEB_IDENTITY_TOKEN_FILE:=}

src/ogx/distributions/starter/run-with-postgres-store.yaml

@@ -43,7 +43,7 @@ providers:
   - provider_id: bedrock
     provider_type: remote::bedrock
     config:
-      api_key: ${env.AWS_BEARER_TOKEN_BEDROCK:=}
+      aws_bedrock_bearer_token: ${env.AWS_BEDROCK_BEARER_TOKEN:=}
       region_name: ${env.AWS_DEFAULT_REGION:=us-east-2}
       aws_role_arn: ${env.AWS_ROLE_ARN:=}
       aws_web_identity_token_file: ${env.AWS_WEB_IDENTITY_TOKEN_FILE:=}

src/ogx/providers/registry/inference.py

@@ -125,7 +125,10 @@ def available_providers() -> list[ProviderSpec]:
             module="ogx.providers.remote.inference.bedrock",
             config_class="ogx.providers.remote.inference.bedrock.BedrockConfig",
             provider_data_validator="ogx.providers.remote.inference.bedrock.config.BedrockProviderDataValidator",
-            description="AWS Bedrock inference provider using OpenAI compatible endpoint.",
+            description=(
+                "AWS Bedrock inference provider for the OpenAI-compatible runtime, "
+                "with AWS credential-chain auth by default and an optional bearer-token override."
+            ),
         ),
         RemoteProviderSpec(
             api=Api.inference,

src/ogx/providers/remote/inference/bedrock/bedrock.py

@@ -48,12 +48,14 @@ class BedrockInferenceAdapter(OpenAIMixin):
     Supports Llama models across regions and GPT-OSS models (us-west-2 only).
 
     Authentication modes:
-    1. Bearer token (legacy): Set AWS_BEARER_TOKEN_BEDROCK or api_key in config
-    2. AWS credential chain (enterprise): Leave api_key unset, configure AWS creds
+    1. AWS credential chain (recommended): Leave aws_bedrock_bearer_token unset
+       and configure AWS credentials for the server environment
        - Web Identity Federation (IRSA, GitHub Actions OIDC)
        - IAM roles (EC2, ECS, Lambda)
        - AWS profiles
        - Static credentials
+    2. Bearer token (optional compatibility mode): Set aws_bedrock_bearer_token in
+       config or pass it per request in x-ogx-provider-data
 
     When using AWS credential chain, requests are signed using SigV4 with the
     "bedrock" signing name (note: the endpoint hostname uses "bedrock-runtime",
@@ -88,7 +90,7 @@ class BedrockInferenceAdapter(OpenAIMixin):
     for dynamic model discovery. Models must be pre-registered in the config.
     """
 
-    provider_data_api_key_field: str | None = "aws_bearer_token_bedrock"
+    provider_data_api_key_field: str | None = "aws_bedrock_bearer_token"
 
     # built once in initialize() so get_extra_client_params() can stay sync;
     # reusing one client also avoids opening a new socket per request
@@ -112,8 +114,8 @@ def _should_use_sigv4(self) -> bool:
             return False
 
         provider_data = self.get_request_provider_data()
-        if provider_data and provider_data.aws_bearer_token_bedrock is not None:
-            val = provider_data.aws_bearer_token_bedrock.get_secret_value()
+        if provider_data and provider_data.aws_bedrock_bearer_token is not None:
+            val = provider_data.aws_bedrock_bearer_token.get_secret_value()
             if val and val.strip():
                 return False
 

src/ogx/providers/remote/inference/bedrock/config.py

@@ -6,17 +6,22 @@
 
 import os
 
-from pydantic import BaseModel, Field, SecretStr
+from pydantic import AliasChoices, BaseModel, Field, SecretStr
 
 from ogx.providers.utils.bedrock.config import BedrockBaseConfig
 
 
 class BedrockProviderDataValidator(BaseModel):
     """Validates provider-specific request data for AWS Bedrock inference."""
 
-    aws_bearer_token_bedrock: SecretStr | None = Field(
+    aws_bedrock_bearer_token: SecretStr | None = Field(
         default=None,
-        description="API Key (Bearer token) for Amazon Bedrock",
+        alias="aws_bedrock_bearer_token",
+        validation_alias=AliasChoices("aws_bedrock_bearer_token", "aws_bearer_token_bedrock"),
+        description=(
+            "Optional per-request bearer token for Amazon Bedrock's OpenAI-compatible runtime. "
+            "Leave unset to use the server's AWS credential chain instead."
+        ),
     )
 
 
@@ -25,8 +30,12 @@ class BedrockConfig(BedrockBaseConfig):
 
     auth_credential: SecretStr | None = Field(
         default=None,
-        description="Authentication credential for the provider",
-        alias="api_key",
+        alias="aws_bedrock_bearer_token",
+        validation_alias=AliasChoices("aws_bedrock_bearer_token", "api_key"),
+        description=(
+            "Optional bearer token for Amazon Bedrock's OpenAI-compatible runtime. "
+            "Leave unset to use the server's AWS credential chain (recommended)."
+        ),
     )
     # Override region_name to default to us-east-2 when unset
     region_name: str | None = Field(
@@ -44,7 +53,7 @@ def has_bearer_token(self) -> bool:
     @classmethod
     def sample_run_config(cls, **kwargs):
         return {
-            "api_key": "${env.AWS_BEARER_TOKEN_BEDROCK:=}",
+            "aws_bedrock_bearer_token": "${env.AWS_BEDROCK_BEARER_TOKEN:=}",
             "region_name": "${env.AWS_DEFAULT_REGION:=us-east-2}",
             "aws_role_arn": "${env.AWS_ROLE_ARN:=}",
             "aws_web_identity_token_file": "${env.AWS_WEB_IDENTITY_TOKEN_FILE:=}",

tests/unit/providers/inference/bedrock/test_sigv4_auth.py

@@ -174,7 +174,13 @@ def test_has_bearer_token_with_token(self):
         """Config should detect when bearer token is present."""
         from ogx.providers.remote.inference.bedrock.config import BedrockConfig
 
-        # Use api_key as that's the alias for auth_credential
+        config = BedrockConfig(aws_bedrock_bearer_token="my-bearer-token")
+        assert config.has_bearer_token() is True
+
+    def test_has_bearer_token_with_legacy_api_key_alias(self):
+        """Config should keep accepting the legacy api_key alias."""
+        from ogx.providers.remote.inference.bedrock.config import BedrockConfig
+
         config = BedrockConfig(api_key="my-bearer-token")
         assert config.has_bearer_token() is True
 
@@ -189,14 +195,14 @@ def test_has_bearer_token_with_empty_string(self):
         """Empty string should be treated as no token."""
         from ogx.providers.remote.inference.bedrock.config import BedrockConfig
 
-        config = BedrockConfig(api_key="")
+        config = BedrockConfig(aws_bedrock_bearer_token="")
         assert config.has_bearer_token() is False
 
     def test_has_bearer_token_with_whitespace(self):
         """Whitespace-only string should be treated as no token."""
         from ogx.providers.remote.inference.bedrock.config import BedrockConfig
 
-        config = BedrockConfig(api_key="   ")
+        config = BedrockConfig(aws_bedrock_bearer_token="   ")
         assert config.has_bearer_token() is False
 
 
@@ -222,7 +228,7 @@ def test_should_not_use_sigv4_when_bearer_token_in_config(self):
 
         config = BedrockConfig(
             region_name="us-east-1",
-            api_key="my-bearer-token",  # Use api_key alias
+            aws_bedrock_bearer_token="my-bearer-token",
         )
         adapter = BedrockInferenceAdapter(config=config)
 
@@ -240,6 +246,21 @@ def test_should_not_use_sigv4_when_bearer_token_in_provider_data(self):
         config = BedrockConfig(region_name="us-east-1")
         adapter = BedrockInferenceAdapter(config=config)
 
+        provider_data = BedrockProviderDataValidator(aws_bedrock_bearer_token="per-request-token")
+        with patch.object(adapter, "get_request_provider_data", return_value=provider_data):
+            assert adapter._should_use_sigv4() is False
+
+    def test_should_not_use_sigv4_when_legacy_provider_data_alias_is_used(self):
+        """Legacy provider-data key should still trigger bearer auth."""
+        from ogx.providers.remote.inference.bedrock.bedrock import BedrockInferenceAdapter
+        from ogx.providers.remote.inference.bedrock.config import (
+            BedrockConfig,
+            BedrockProviderDataValidator,
+        )
+
+        config = BedrockConfig(region_name="us-east-1")
+        adapter = BedrockInferenceAdapter(config=config)
+
         provider_data = BedrockProviderDataValidator(aws_bearer_token_bedrock="per-request-token")
         with patch.object(adapter, "get_request_provider_data", return_value=provider_data):
             assert adapter._should_use_sigv4() is False
@@ -248,7 +269,7 @@ def test_get_extra_client_params_skips_sigv4_client_when_bearer_override(self):
         """Per-request bearer token override must not be silently discarded by the SigV4 client.
 
         When the server starts in SigV4 mode (_sigv4_http_client is not None) but a request
-        arrives with aws_bearer_token_bedrock in provider data, get_extra_client_params()
+        arrives with aws_bedrock_bearer_token in provider data, get_extra_client_params()
         must return {} so the OpenAI SDK uses the bearer token instead of SigV4 auth.
         """
         from unittest.mock import MagicMock
@@ -266,7 +287,7 @@ def test_get_extra_client_params_skips_sigv4_client_when_bearer_override(self):
         adapter._sigv4_http_client = MagicMock()
 
         # Per-request bearer token override in provider data
-        provider_data = BedrockProviderDataValidator(aws_bearer_token_bedrock="per-request-token")
+        provider_data = BedrockProviderDataValidator(aws_bedrock_bearer_token="per-request-token")
         with patch.object(adapter, "get_request_provider_data", return_value=provider_data):
             params = adapter.get_extra_client_params()
             # Must return {} — the bearer token path must not receive the SigV4 http_client,
@@ -301,7 +322,7 @@ def test_should_use_sigv4_when_provider_data_token_is_whitespace(self):
         adapter = BedrockInferenceAdapter(config=config)
 
         # Whitespace-only token should be treated as no token (use SigV4)
-        provider_data = BedrockProviderDataValidator(aws_bearer_token_bedrock="   ")
+        provider_data = BedrockProviderDataValidator(aws_bedrock_bearer_token="   ")
         with patch.object(adapter, "get_request_provider_data", return_value=provider_data):
             assert adapter._should_use_sigv4() is True
 

tests/unit/providers/inference/test_bedrock_adapter.py

@@ -17,33 +17,33 @@
 
 
 def test_adapter_initialization():
-    config = BedrockConfig(api_key="test-key", region_name="us-east-1")
+    config = BedrockConfig(aws_bedrock_bearer_token="test-key", region_name="us-east-1")
     adapter = BedrockInferenceAdapter(config=config)
 
     assert adapter.config.auth_credential.get_secret_value() == "test-key"
     assert adapter.config.region_name == "us-east-1"
 
 
 def test_client_url_construction():
-    config = BedrockConfig(api_key="test-key", region_name="us-west-2")
+    config = BedrockConfig(aws_bedrock_bearer_token="test-key", region_name="us-west-2")
     adapter = BedrockInferenceAdapter(config=config)
 
     assert adapter.get_base_url() == "https://bedrock-runtime.us-west-2.amazonaws.com/openai/v1"
 
 
 def test_api_key_from_config():
-    config = BedrockConfig(api_key="config-key", region_name="us-east-1")
+    config = BedrockConfig(aws_bedrock_bearer_token="config-key", region_name="us-east-1")
     adapter = BedrockInferenceAdapter(config=config)
     assert adapter.config.auth_credential.get_secret_value() == "config-key"
 
 
 def test_api_key_from_header_overrides_config():
     """Test API key from request header overrides config via client property"""
-    config = BedrockConfig(api_key="config-key", region_name="us-east-1")
+    config = BedrockConfig(aws_bedrock_bearer_token="config-key", region_name="us-east-1")
     adapter = BedrockInferenceAdapter(config=config)
-    adapter.provider_data_api_key_field = "aws_bearer_token_bedrock"
+    adapter.provider_data_api_key_field = "aws_bedrock_bearer_token"
     adapter.get_request_provider_data = MagicMock(
-        return_value=SimpleNamespace(aws_bearer_token_bedrock=SecretStr("header-key"))
+        return_value=SimpleNamespace(aws_bedrock_bearer_token=SecretStr("header-key"))
     )
 
     # The client property is where header override happens (in OpenAIMixin)
@@ -52,7 +52,7 @@ def test_api_key_from_header_overrides_config():
 
 async def test_authentication_error_handling():
     """Authentication failures should surface as a sanitized InternalServerError."""
-    config = BedrockConfig(api_key="invalid-key", region_name="us-east-1")
+    config = BedrockConfig(aws_bedrock_bearer_token="invalid-key", region_name="us-east-1")
     adapter = BedrockInferenceAdapter(config=config)
 
     # Mock the parent class method to raise AuthenticationError