fix(bedrock): let explicit AWS keys win over the env bearer token on native Chat Completions

litellm/llms/bedrock/chat/chat_completions/transformation.py

@@ -47,6 +47,7 @@ from litellm.llms.bedrock.common_utils import (
 )
 from litellm.llms.openai.chat.gpt_transformation import OpenAIChatCompletionStreamingHandler
 from litellm.llms.openai_like.chat.transformation import OpenAILikeChatConfig
+from litellm.types.llms.bedrock import AwsAuthParams
 from litellm.types.llms.openai import AllMessageValues
 from litellm.types.utils import Choices, ModelResponse, ModelResponseStream
 
@@ -355,7 +356,7 @@ class AmazonBedrockRuntimeChatCompletionsConfig(OpenAILikeChatConfig):
             messages=messages,
             optional_params=optional_params,
             litellm_params=litellm_params,
-            api_key=bedrock_bearer_token(api_key),
+            api_key=bedrock_bearer_token(api_key, AwsAuthParams.model_validate(optional_params)),
             api_base=api_base,
         )
 

tests/unit/llms/bedrock/chat/chat_completions/test_bedrock_chat_completions_transformation.py

@@ -550,6 +550,36 @@ def test_bearer_api_key_is_sent_as_the_authorization_header(monkeypatch):
     assert headers["Authorization"] == "Bearer bedrock-api-key"
 
 
+@pytest.mark.parametrize(
+    "auth_kwargs, authorization_prefix",
+    [
+        (
+            {
+                "aws_access_key_id": SIGV4_PARAMS["aws_access_key_id"],
+                "aws_secret_access_key": SIGV4_PARAMS["aws_secret_access_key"],
+            },
+            f"AWS4-HMAC-SHA256 Credential={SIGV4_PARAMS['aws_access_key_id']}/",
+        ),
+        ({}, "Bearer env-bedrock-token"),
+    ],
+    ids=["explicit-keys-sign-sigv4", "no-keys-use-env-token"],
+)
+def test_explicit_aws_keys_win_over_the_env_bearer_token(
+    local_cost_map, fake_aws_env, monkeypatch, auth_kwargs, authorization_prefix
+):
+    monkeypatch.setenv("AWS_BEARER_TOKEN_BEDROCK", "env-bedrock-token")
+    requests, client = _recording_client(json=_chat_completion_json("ok", "us.xai.grok-4.6"))
+    litellm.completion(
+        model="bedrock/chat_completions/us.xai.grok-4.6",
+        messages=[{"role": "user", "content": "hello"}],
+        client=client,
+        **auth_kwargs,
+    )
+
+    assert len(requests) == 1
+    assert requests[0].headers["Authorization"].startswith(authorization_prefix), requests[0].headers
+
+
 @pytest.mark.parametrize(
     "request_params, expected_route",
     [