fix(bedrock): preserve bearer token env compatibility

.github/workflows/integration-tests.yml

@@ -204,6 +204,7 @@ jobs:
           VERTEX_AI_PROJECT: ${{ matrix.config.setup == 'vertexai' && 'replay-mode-dummy-project' || '' }}
           VERTEX_AI_LOCATION: ${{ matrix.config.setup == 'vertexai' && 'global' || '' }}
           AWS_BEDROCK_BEARER_TOKEN: replay-mode-dummy-key
+          AWS_BEARER_TOKEN_BEDROCK: replay-mode-dummy-key
           AWS_DEFAULT_REGION: us-west-2
           GEMINI_API_KEY: replay-mode-dummy-key
           TAVILY_SEARCH_API_KEY: ${{ secrets.TAVILY_SEARCH_API_KEY || 'replay-mode-dummy-key' }}

.github/workflows/record-integration-tests.yml

@@ -276,6 +276,7 @@ jobs:
           GEMINI_API_KEY: ${{ matrix.provider.setup == 'gemini' && secrets.GEMINI_API_KEY || '' }}
           TAVILY_SEARCH_API_KEY: ${{ contains(fromJSON('["gpt","azure","vertexai"]'), matrix.provider.setup) && secrets.TAVILY_SEARCH_API_KEY || '' }}
           AWS_BEDROCK_BEARER_TOKEN: ${{ matrix.provider.setup == 'bedrock' && secrets.AWS_BEARER_TOKEN_BEDROCK || '' }}
+          AWS_BEARER_TOKEN_BEDROCK: ${{ matrix.provider.setup == 'bedrock' && secrets.AWS_BEARER_TOKEN_BEDROCK || '' }}
           AWS_DEFAULT_REGION: ${{ matrix.provider.setup == 'bedrock' && 'us-west-2' || '' }}
         with:
           stack-config: 'server:ci-tests'

scripts/integration-tests.sh

@@ -504,6 +504,7 @@ if [[ "$STACK_CONFIG" == *"docker:"* && "$COLLECT_ONLY" == false ]]; then
     [ -n "${GEMINI_API_KEY:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e GEMINI_API_KEY=$GEMINI_API_KEY"
     [ -n "${OLLAMA_URL:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e OLLAMA_URL=$OLLAMA_URL"
     [ -n "${AWS_BEDROCK_BEARER_TOKEN:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e AWS_BEDROCK_BEARER_TOKEN=$AWS_BEDROCK_BEARER_TOKEN"
+    [ -n "${AWS_BEARER_TOKEN_BEDROCK:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e AWS_BEARER_TOKEN_BEDROCK=$AWS_BEARER_TOKEN_BEDROCK"
     [ -n "${AWS_DEFAULT_REGION:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION"
     [ -n "${VERTEX_AI_PROJECT:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e VERTEX_AI_PROJECT=$VERTEX_AI_PROJECT"
     [ -n "${VERTEX_AI_LOCATION:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e VERTEX_AI_LOCATION=$VERTEX_AI_LOCATION"

src/ogx/providers/remote/inference/bedrock/config.py

@@ -11,6 +11,13 @@
 from ogx.providers.utils.bedrock.config import BedrockBaseConfig
 
 
+def _bedrock_bearer_token_from_env() -> SecretStr | None:
+    token = os.getenv("AWS_BEDROCK_BEARER_TOKEN") or os.getenv("AWS_BEARER_TOKEN_BEDROCK")
+    if token is None:
+        return None
+    return SecretStr(token)
+
+
 class BedrockProviderDataValidator(BaseModel):
     """Validates provider-specific request data for AWS Bedrock inference."""
 
@@ -29,9 +36,9 @@ class BedrockConfig(BedrockBaseConfig):
     """Configuration for the AWS Bedrock inference provider."""
 
     auth_credential: SecretStr | None = Field(
-        default=None,
+        default_factory=_bedrock_bearer_token_from_env,
         alias="aws_bedrock_bearer_token",
-        validation_alias=AliasChoices("aws_bedrock_bearer_token", "api_key"),
+        validation_alias=AliasChoices("aws_bedrock_bearer_token", "aws_bearer_token_bedrock", "api_key"),
         description=(
             "Optional bearer token for Amazon Bedrock's OpenAI-compatible runtime. "
             "Leave unset to use the server's AWS credential chain (recommended)."

tests/unit/providers/inference/test_bedrock_config.py

@@ -9,6 +9,7 @@
 
 def test_bedrock_config_defaults_no_env(monkeypatch):
     """Test BedrockConfig defaults when env vars are not set"""
+    monkeypatch.delenv("AWS_BEDROCK_BEARER_TOKEN", raising=False)
     monkeypatch.delenv("AWS_BEARER_TOKEN_BEDROCK", raising=False)
     monkeypatch.delenv("AWS_DEFAULT_REGION", raising=False)
     config = BedrockConfig()
@@ -23,13 +24,33 @@ def test_bedrock_config_reads_from_env(monkeypatch):
     assert config.region_name == "eu-west-1"
 
 
+def test_bedrock_config_reads_canonical_bearer_token_env(monkeypatch):
+    monkeypatch.setenv("AWS_BEDROCK_BEARER_TOKEN", "canonical-token")
+    monkeypatch.setenv("AWS_BEARER_TOKEN_BEDROCK", "legacy-token")
+    config = BedrockConfig()
+    assert config.auth_credential.get_secret_value() == "canonical-token"
+
+
+def test_bedrock_config_reads_legacy_bearer_token_env(monkeypatch):
+    monkeypatch.delenv("AWS_BEDROCK_BEARER_TOKEN", raising=False)
+    monkeypatch.setenv("AWS_BEARER_TOKEN_BEDROCK", "legacy-token")
+    config = BedrockConfig()
+    assert config.auth_credential.get_secret_value() == "legacy-token"
+
+
 def test_bedrock_config_with_values():
     """Test BedrockConfig accepts explicit values via the canonical field name."""
     config = BedrockConfig(aws_bedrock_bearer_token="test-key", region_name="us-west-2")
     assert config.auth_credential.get_secret_value() == "test-key"
     assert config.region_name == "us-west-2"
 
 
+def test_bedrock_config_legacy_field_alias_still_works():
+    """Test BedrockConfig keeps accepting the legacy Bedrock token field alias."""
+    config = BedrockConfig(aws_bearer_token_bedrock="legacy-key", region_name="us-west-2")
+    assert config.auth_credential.get_secret_value() == "legacy-key"
+
+
 def test_bedrock_config_legacy_api_key_alias_still_works():
     """Test BedrockConfig keeps accepting the legacy api_key alias."""
     config = BedrockConfig(api_key="legacy-key", region_name="us-west-2")