Bedrock API keys: call Claude from the EU

TL;DR

Bedrock API keys authenticate Claude calls as a bearer token instead of SigV4. A short-term key lasts at most 12 hours and only in the Region where you created it, typically Frankfurt. A long-term key is for exploration, not production. Residency still needs the EU profile eu.anthropic.claude-sonnet-5-5. The key does not replace an IAM role or your DPA.

What is a Bedrock API key, and what is it not?

A Bedrock API key is a bearer token scoped to Amazon Bedrock and Bedrock Runtime. You set AWS_BEARER_TOKEN_BEDROCK or send Authorization: Bearer. AWS recommends short-term keys or temporary credentials in production. Residency, retention and the DPA stay separate switches. It is not an Anthropic sk-ant key.

The overview splits two types. A short-term key inherits the IAM principal that created it. It lasts for the shorter of 12 hours and that session. It works only in the Region where you generated it. A long-term key creates an IAM user, attaches the policies you pick, and stores the token as a service-specific credential for bedrock.amazonaws.com. The console attaches AmazonBedrockLimitedAccess by default.

CloudTrail logs every API call. It does not log the token in the Authorization header. The reference excludes three families: InvokeModelWithBidirectionalStream, Agents for Amazon Bedrock and Data Automation. Agents and Knowledge Bases still need SigV4.

Four AWS services support service API keys: Bedrock, Claude Platform on AWS, CloudWatch and CloudWatch Logs. Claude Platform on AWS is a different product. Its managed policy is AnthropicInferenceAccess and its service name is aws-external-anthropic.amazonaws.com. Do not mix the two paths.

The platform, EU profiles and a first call are in Amazon Bedrock explained. The Anthropic key that cannot pin processing to the EU is in how to create a Claude API key.

We recommend Bedrock API keys for exploration and for scripts that have no SDK credential chain. Once the app runs on ECS, Lambda or EKS, use an IAM role.

How do you create a short-term key in Frankfurt?

Open the Bedrock console in eu-central-1, choose API keys, then Generate short-term API keys. The token lasts at most 12 hours and only in Frankfurt. In production, aws-bedrock-token-generator fetches a fresh token before each request. The EU profile remains the model ID.

The generate page requires an IAM principal that can use Bedrock. AmazonBedrockLimitedAccess is enough for a test. Switch Region in the console before you generate the key. A token from us-east-1 fails in Frankfurt with Credential should be scoped to a valid region, even when the model ID and URL are correct.

1. Open the Bedrock console in eu-central-1.
2. Choose API keys in the left pane, Short-term API keys tab.
3. Choose Generate short-term API keys.
4. Copy the token immediately. The console shows it once.
5. Export it: export AWS_BEARER_TOKEN_BEDROCK=...
6. Call Converse with the EU profile, not global. and not us..

For scripts, install the token generator. The Java library is version 1.1.0 in the docs. The Python package reads the default credential chain:

pip install aws-bedrock-token-generator boto3
export AWS_REGION=eu-central-1

from aws_bedrock_token_generator import provide_token
import boto3
import os

os.environ["AWS_BEARER_TOKEN_BEDROCK"] = provide_token()
client = boto3.client("bedrock-runtime", region_name="eu-central-1")
response = client.converse(
    modelId="eu.anthropic.claude-sonnet-5-5",
    messages=[{"role": "user", "content": [{"text": "Hello from Frankfurt"}]}],
)
print(response["output"]["message"]["content"][0]["text"])

Call provide_token() before each request. The library caches the token and refreshes it when it expires, so a long-running process stays inside the 12-hour window without a long-term key.

curl against the regional host, not a US host:

curl -X POST "https://bedrock-runtime.eu-central-1.amazonaws.com/model/eu.anthropic.claude-sonnet-5-5/converse" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $AWS_BEARER_TOKEN_BEDROCK" \
  -d '{"messages":[{"role":"user","content":[{"text":"Hello"}]}]}'

The private network path without NAT is in Bedrock PrivateLink in the EU. The bearer header does not change there.

When is a long-term key acceptable?

Only for exploration. The console offers 1, 5, 30, 90 or 365 days, a custom date, or never. The CLI accepts 1 to 36600 days. Omit --credential-age-days and the key does not expire. Each IAM user may hold two keys per service. Production uses short-term keys or a role.

The IAM page on service API keys lists the console expirations. CreateServiceSpecificCredential sets the hard limit: two credential sets per service per user, age 1 to 36600 days. ServiceApiKeyValue is the token. You see it once. Lost means reset or create a new one.

AWS repeats the same warning on every one of these pages: long-term keys are for exploration. For applications with higher security needs, switch to short-term credentials. We agree. A production VPC that sends personal data to Frankfurt should not keep a 365-day token in a .env file.

CLI for a 30-day key, as in the 30-day tutorial:

aws iam create-user --user-name bedrock-api-user
aws iam attach-user-policy --user-name bedrock-api-user \
  --policy-arn arn:aws:iam::aws:policy/AmazonBedrockLimitedAccess
aws iam create-service-specific-credential \
  --user-name bedrock-api-user \
  --service-name bedrock.amazonaws.com \
  --credential-age-days 30

Keep ServiceSpecificCredentialId. You need it to deactivate, reset or delete the key:

aws iam update-service-specific-credential \
  --user-name bedrock-api-user \
  --service-specific-credential-id "$ID" \
  --status Inactive

The permissions page ships a policy that allows long-term keys only for Bedrock and only up to 90 days. You cannot stop short-term key generation. You can deny their use with bedrock:CallWithBearerToken and bedrock-mantle:CallWithBearerToken plus bearerTokenType=SHORT_TERM. To block bearer tokens entirely, deny both actions.

We recommend an org rule: long-term keys cap at 30 days, never is forbidden, two keys exist only for rotation. If a token leaks, deactivate it and invalidate the creator session.

IAM role, Bedrock key or Anthropic key?

For EU production the IAM role stays the default. A Bedrock key is the faster prototype on the same EU profile. An Anthropic key only knows global and us. Google Cloud uses ADC or gcloud auth print-access-token. Foundry has no EU data zone.

The table is the 26 October 2026 snapshot. Prices are list prices in USD per million tokens for Sonnet 5.5. The regional Bedrock EU profile sits 10 percent above the global rate, the premium Anthropic documents from Sonnet 4.5 for regional and multi-region endpoints.

Route	Credential	EU processing	Sonnet 5.5 list price
Bedrock, IAM role, eu. profile	SigV4 via role or SSO	Yes, EU geo	2.20 / 11.00
Bedrock, short-term key in Frankfurt	Bearer, max 12 hours	Yes, if eu. and an EU Region	2.20 / 11.00
Bedrock, long-term key	Bearer, 1 to 365 days	Yes, if eu. and the same Region	2.20 / 11.00
Claude API, sk-ant	Anthropic key	No, global or US only	2.00 / 10.00
Google Cloud, ADC	gcloud auth application-default login	Yes, via the EU endpoint	10 percent regional premium
Foundry	Azure Marketplace, CCU	No, Global or US zone	0.01 USD per CCU

The IAM path and the deny on global routing are in Claude on AWS Bedrock in the EU. Google authenticates, on the Claude on Vertex page, with ADC for SDKs and gcloud auth print-access-token for curl. The identity needs aiplatform.endpoints.predict, typically roles/aiplatform.user. The EU host is in Claude on Vertex AI in Europe.

Foundry is the odd one out. The hosting comparison names Anthropic as seller and processor. Deployment types are Global Standard and Data Zone Standard (US). There is no EU zone. CCU is 0.01 USD, 100 CCU equal 1 USD. Foundry details sit in Azure AI Foundry explained.

We recommend: prototype with a short-term key on synthetic data in Frankfurt. Move anything with personal data onto a task role. Leave the Anthropic key for EU data.

What does the path cost, and where does residency stay?

The key itself is free. You pay tokens. Sonnet 5.5 is 2 / 10 USD globally. The regional EU profile adds 10 percent. Batch halves the rate. Residency needs eu.anthropic.claude-sonnet-5-5 from an EU source Region. In-region on bedrock-runtime is not available for Sonnet 5.5.

The pricing page lists Sonnet 5.5 at 2 USD input and 10 USD output per million tokens. Cache hits are 0.05x, so 0.10 USD. Batch: 1 / 5. From Sonnet 4.5, Haiku 4.5 and Opus 4.5, regional and multi-region endpoints add 10 percent. US-only inference_geo: "us" on the first-party API applies 1.1x. CCU on Claude Platform on AWS and Foundry: 0.01 USD, 100 CCU = 1 USD.

The model card sets launch at 28 September 2026 and EOL no sooner than 28 September 2027. Context is 1 million tokens, output 128,000. Geo ID eu.anthropic.claude-sonnet-5-5. From Frankfurt the profile routes to Frankfurt, Stockholm, Milan, Spain, Ireland and Paris. London joins only when the source is London. In-region on bedrock-runtime is N/A. Prompt cache: 512-token minimum, 4 checkpoints, TTL of 5 minutes and 1 hour.

Geographic CRIS keeps processing inside the geography. Prompts can leave the source Region. Abuse-detection storage sits in the destination Region. The key does not change that. A token from Ireland plus global.anthropic.claude-sonnet-5-5 leaves the EU. A token from Frankfurt plus eu.anthropic.claude-sonnet-5-5 stays on the EU destination list.

Worked example, our arithmetic, list price: 20 million input and 2 million output Sonnet 5.5 on the EU profile. Global would be 40 plus 20, so 60 USD. Plus 10 percent: 66 USD. The key does not appear on the invoice.

Token prices and the Anthropic vs Bedrock vs Vertex comparison are in Claude API pricing in the EU.

FAQ

What do Bedrock API keys cost?

Nothing extra. AWS issues the token with no separate fee line. You pay model prices: Sonnet 5.5 is 2 / 10 USD per million tokens, 10 percent more on a regional endpoint, 50 percent less in batch. 100 CCU on Claude Platform on AWS or Foundry equal 1 USD.

Bedrock API key vs IAM role: what should EU teams pick?

The IAM role, once the app runs on AWS. A short-term key fits local scripts and clients without SigV4. A long-term key stays exploration. Residency hangs on the eu. profile and the source Region, not on the credential type.

Can I display a lost long-term key again?

No. IAM says that after you close the dialog the value is gone. Reset issues a new token and invalidates the old one. Deactivate stops use without deleting. Two keys per user let you rotate before the old one dies.

Do Bedrock API keys work with Agents and Knowledge Bases?

No. The reference excludes Agents, Data Automation and InvokeModelWithBidirectionalStream. Converse, InvokeModel and the OpenAI-compatible APIs on bedrock-runtime work. Agents still need SigV4.

Does a Bedrock API key replace the EU profile?

No. The token authenticates. The profile decides where the request routes. Without eu., the same call can run globally even if you created the key in Frankfurt. In-region on bedrock-runtime is not available for Sonnet 5.5.

Can I ban short-term keys in the organisation?

You cannot ban generation. AWS says so in plain language. You can ban use by denying bedrock:CallWithBearerToken and bedrock-mantle:CallWithBearerToken with bearerTokenType=SHORT_TERM. For long-term keys, deny iam:CreateServiceSpecificCredential or cap age and service name.

Sources

1. AWS Bedrock: API keys (26 October 2026)
2. AWS Bedrock: Generate an API key (26 October 2026)
3. AWS Bedrock: Use an API key (26 October 2026)
4. AWS Bedrock: Control API key permissions (26 October 2026)
5. AWS Bedrock: API keys reference (26 October 2026)
6. AWS IAM: API keys for AWS services (26 October 2026)
7. AWS IAM: CreateServiceSpecificCredential (26 October 2026)
8. AWS Bedrock: Claude Sonnet 5.5 model card (26 October 2026)
9. AWS Bedrock: Geographic cross-Region inference (26 October 2026)
10. Anthropic: Pricing (26 October 2026)
11. Anthropic: Claude on Vertex AI (26 October 2026)
12. Microsoft Learn: Claude hosting comparison (26 October 2026)