[BEDROCK-AUTH-0100] Add AWS-native Bedrock authentication

README.md

@@ -944,7 +944,7 @@ response = client.responses.create(
 print(response.output_text)
 ```
 
-`BedrockOpenAI` configures AWS bearer auth and the Bedrock Mantle endpoint, then uses the normal SDK resources. AWS controls which endpoints and features are supported; unsupported calls surface the provider's normal HTTP errors through the SDK.
+`BedrockOpenAI` configures AWS authentication and the Bedrock Mantle endpoint, then uses the normal SDK resources. AWS controls which endpoints and features are supported; unsupported calls surface the provider's normal HTTP errors through the SDK.
 
 Pass `base_url` or set `AWS_BEDROCK_BASE_URL` to override the derived `https://bedrock-mantle.<region>.api.aws/openai/v1` endpoint. The legacy module client supports `openai.api_type = "amazon-bedrock"` or `OPENAI_API_TYPE=amazon-bedrock`.
 
@@ -957,6 +957,21 @@ client = BedrockOpenAI(
 )
 ```
 
+To use the standard AWS credential chain and SigV4 authentication, install the Bedrock extra and omit bearer-token configuration:
+
+```sh
+pip install 'openai[bedrock]'
+```
+
+```py
+client = BedrockOpenAI(
+    aws_region="us-west-2",
+    aws_profile="my-profile",  # optional; otherwise uses the default AWS credential chain
+)
+```
+
+You can also pass explicit temporary credentials or an `aws_credentials_provider` that returns botocore-compatible credentials. Explicit bearer and AWS credential options are mutually exclusive. Without explicit authentication, `AWS_BEARER_TOKEN_BEDROCK` takes precedence over the default AWS credential chain.
+
 ## Versioning
 
 This package generally follows [SemVer](https://semver.org/spec/v2.0.0.html) conventions, though certain backwards-incompatible changes may be released as minor versions:

pyproject.toml

@@ -47,6 +47,10 @@ aiohttp = ["aiohttp", "httpx_aiohttp>=0.1.9"]
 realtime = ["websockets >= 13, < 16"]
 datalib = ["numpy >= 1", "pandas >= 1.2.3", "pandas-stubs >= 1.1.0.11"]
 voice_helpers = ["sounddevice>=0.5.1", "numpy>=2.0.2"]
+bedrock = [
+  "botocore[crt]>=1.42.0,<1.43; python_version < '3.10'",
+  "botocore[crt]>=1.42.0,<2; python_version >= '3.10'",
+]
 
 [tool.rye]
 managed = true
@@ -65,6 +69,7 @@ dev-dependencies = [
     "rich>=13.7.1",
     "inline-snapshot>=0.28.0",
     "azure-identity >=1.14.1",
+    "botocore==1.42.97",
     "types-tqdm > 4",
     "types-pyaudio > 0",
     "trio >=0.22.2",

requirements-dev.lock

@@ -33,11 +33,15 @@ attrs==25.4.0
     # via nox
     # via outcome
     # via trio
+awscrt==0.31.2
+    # via botocore
 azure-core==1.36.0
     # via azure-identity
 azure-identity==1.25.1
 backports-asyncio-runner==1.2.0
     # via pytest-asyncio
+botocore==1.42.97
+    # via openai
 certifi==2026.1.4
     # via httpcore
     # via httpx
@@ -100,6 +104,8 @@ iniconfig==2.1.0
 inline-snapshot==0.31.1
 jiter==0.12.0
     # via openai
+jmespath==1.1.0
+    # via botocore
 markdown-it-py==3.0.0
     # via rich
 mdurl==0.1.2
@@ -218,6 +224,7 @@ typing-inspection==0.4.2
 tzdata==2025.2
     # via pandas
 urllib3==2.5.0
+    # via botocore
     # via requests
     # via types-requests
 virtualenv==20.35.4

requirements.lock

@@ -26,6 +26,10 @@ async-timeout==5.0.1
     # via aiohttp
 attrs==25.4.0
     # via aiohttp
+awscrt==0.31.2
+    # via botocore
+botocore==1.42.97
+    # via openai
 certifi==2026.1.4
     # via httpcore
     # via httpx
@@ -53,6 +57,8 @@ idna==3.11
     # via yarl
 jiter==0.12.0
     # via openai
+jmespath==1.1.0
+    # via botocore
 multidict==6.7.0
     # via aiohttp
     # via yarl
@@ -100,6 +106,8 @@ typing-inspection==0.4.2
     # via pydantic
 tzdata==2025.2
     # via pandas
+urllib3==1.26.20
+    # via botocore
 websockets==15.0.1
     # via openai
 yarl==1.22.0