Amazon Bedrock#

Route Amazon Bedrock calls through Lockpin so they are priced and capped like any other provider’s. This page is for developers and admins who run models on their own AWS account.

How Bedrock works with Lockpin#

Bedrock calls are signed with AWS Signature Version 4, and a signature covers the request. Lockpin changes some requests before sending them (it adds a budget note or fits the output limit), so it holds the AWS credential and signs each call itself. An agent’s own key is never forwarded to Bedrock: its Authorization, x-api-key and X-Amz-* headers are dropped before Lockpin signs.

Lockpin serves Bedrock under three names. All three use the same credential.

Base URL

Bedrock API

Client

Model ids

http://127.0.0.1:8787/bedrock

Claude in Amazon Bedrock (/anthropic/v1/messages)

Anthropic SDK

anthropic.claude-opus-5-5 and the other Opus 4.7-and-later ids

http://127.0.0.1:8787/bedrock-invoke

InvokeModel

Anthropic SDK

anthropic.claude-...-v1:0, us./eu./global. inference profile ids, or ARNs, such as us.anthropic.claude-sonnet-4-5-20250929-v1:0

http://127.0.0.1:8787/bedrock-converse

Converse (/model/<id>/converse and /converse-stream)

An AWS SDK, with this as its endpoint_url

Every Bedrock text model: Amazon Nova, Meta Llama, Mistral, DeepSeek, OpenAI gpt-oss, Qwen and Anthropic

Under /bedrock and /bedrock-invoke only /v1/messages is served. Any other path gets 404 not_supported, so nothing else is signed with your credential.

Before you begin#

  • Lockpin is installed. See Install.

  • You have an AWS access key, or session credentials, with access to the Bedrock models you use.

  • You know the AWS region you call Bedrock in.

Set up Bedrock on your machine#

  1. Set the AWS credential and region in the shell that starts Lockpin.

    $env:AWS_ACCESS_KEY_ID = "..."
$env:AWS_SECRET_ACCESS_KEY = "..."
$env:AWS_REGION = "us-east-1"
lockpin

    export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_REGION=us-east-1
lockpin

    AWS_DEFAULT_REGION works instead of AWS_REGION. For session credentials, also set AWS_SESSION_TOKEN and AWS_CREDENTIAL_EXPIRATION. On macOS and Linux, aws configure export-credentials --format env prints every variable but the region; set AWS_REGION yourself.

  2. Point your agent at Lockpin. With the Anthropic SDK, use /bedrock or /bedrock-invoke as the base URL and the Bedrock model id in model:

    import anthropic
client = anthropic.Anthropic(base_url="http://127.0.0.1:8787/bedrock")

    A bare Anthropic id such as claude-sonnet-4-5 is not a Bedrock id and is refused as unknown.

  3. For other vendors’ models, use an AWS SDK with endpoint_url set to /bedrock-converse, and call converse or converse_stream as usual:

    import boto3
client = boto3.client("bedrock-runtime", endpoint_url="http://127.0.0.1:8787/bedrock-converse")

    The SDK still needs some credential to sign with; any will do. Lockpin drops its signature and signs again with the credential it holds.

Important

Lockpin does not read profiles in ~/.aws, IAM roles or SSO. Export session credentials from them, and export again when they expire. Lockpin refuses expired credentials and does not refresh them.

Set up Bedrock on a team node#

On a team node, the AWS credential is sealed in the node’s store under the name bedrock, and agents hold only Lockpin tokens.

  1. Seal the credential on the node, as the node’s account:

    { aws configure export-credentials --format env; echo AWS_REGION=us-east-1; } | lockpin keys seal bedrock -sealed /var/lib/lockpin/lockpin-node.sealed

    It reads AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION (or AWS_DEFAULT_REGION) and, for session credentials, AWS_SESSION_TOKEN and AWS_CREDENTIAL_EXPIRATION, as NAME=VALUE lines with or without export . It prints nothing but the store’s protection and the node key.

  2. Reseal when session credentials change. A reseal that gives no region keeps the one already sealed, so from the second time on this is enough:

    aws configure export-credentials --format env | lockpin keys seal bedrock

    A running node picks up a reseal within a second. lockpin node install and -key-file take the same lines among the provider=key lines.

  3. Give agents the node’s address, such as http://<node>:8787/bedrock, and their lpc_ token or lp_ key as the API key. With boto3 on /bedrock-converse, the Lockpin key goes as a bearer token when AWS_BEARER_TOKEN_BEDROCK holds it.

    A capability’s models caveat matches the id as sent, so mint it with anthropic.claude-* or *.anthropic.claude-*.

Session credentials expire, and the node does not refresh them. With AWS_CREDENTIAL_EXPIRATION sealed, a call within a minute of it is refused with 503 aws_credentials_expired before anything is reserved. When AWS itself answers that the token expired, the 403 comes back with the same error type. Either way the message says to reseal. A team that uses IAM roles or SSO exports session credentials to the node on a schedule it owns. An IAM user’s long-lived keys need no reseal.

How Bedrock calls are priced#

Route

Price

/bedrock, /bedrock-invoke

The id’s base Anthropic model from the catalog (anthropic.claude-sonnet-4-5-20250929-v1:0 as claude-sonnet-4-5), 10 percent more for a regional id (us., eu., jp., apac., au., or no prefix) than for global.

/bedrock-converse, Anthropic models

As above.

/bedrock-converse, other vendors

AWS’s us-east-1 on-demand price, by base id (us.amazon.nova-lite-v1:0 is amazon.nova-lite).

  • Models before Claude 4.5 keep AWS’s own regional prices, which the catalog does not know. Until you set them with -prices ("bedrock-invoke/<id>": {...}), Lockpin applies the same 10 percent to their regional ids and so overstates them by that much. An explicit entry wins over the derived price.

  • Other vendors’ prices hold for an in-region, us. or global. id signed for us-east-1 only. A call from another region or geography is refused until you set its price with -prices under the id as sent ("bedrock-converse/eu.amazon.nova-pro-v1:0": {...}).

  • A model with no cache price listed is charged a cache hit at its input price.

  • An unlisted model is refused unless -unknown-model-price is set.

Check one invoice line against the ledger either way. See Prices and the price feed for the catalog format.

How Converse calls are capped#

  • The worst case is Lockpin’s estimate of the messages, system prompt and tool configuration, plus 2,560 tokens for each image, plus inferenceConfig.maxTokens of output.

  • A call that sets no limit would run to the model’s maximum, so Lockpin reserves that maximum (on a capped task, what the budget fits) and writes it. The limit sent is always the one reserved for, and X-Lockpin-Output-Limit says what it is.

  • The call settles from the reply’s usage. A stream is relayed as it is and read for its usage. A stream cut short or ended by an exception is charged its reservation.

Limits#

  • On /bedrock and /bedrock-invoke, of an agent’s request headers only Content-Type, Accept, User-Agent, anthropic-version and anthropic-beta go to Bedrock. Bedrock’s own X-Amzn-Bedrock-* headers (service tier, guardrails, latency optimisation) are dropped, since they would bill above what the cap reserved.

  • Converse calls with guardrailConfig, performanceConfig.latency other than standard, or serviceTier other than default or flex are refused, as Lockpin cannot price them.

  • On a capped task, input Lockpin cannot size is refused as unpriced: input in S3 (s3Location), a document other than plain text (txt, csv, md, html), and any video. With no cap, or with -allow-unpriced, these go at the standard price.

  • Also refused on Converse: an output limit of a vendor’s own inside additionalModelRequestFields, a body that names a key twice, and an ARN of a prompt, an application inference profile, or a provisioned or imported model. A foundation-model or system inference-profile ARN is fine.

  • Lockpin’s savings features (compaction, cache markers, budget notes, hand-off notes) do not edit Converse calls. A Converse model cannot be a fallback or downgrade source or target.

  • Not supported in this version: Guardrails, Knowledge Bases, Bedrock bearer tokens, SigV4a, Bedrock’s count-tokens API (Lockpin uses its own estimate), and credential refresh.

Verify#

  1. Check the setup:

    lockpin doctor -providers bedrock

  2. List the Bedrock model ids Lockpin prices:

    lockpin providers -models

  3. Make one call through Lockpin and check that it appears in the meter at http://127.0.0.1:8787/lockpin/. Compare the ledger’s charge with the matching line on your AWS invoice.

Without the AWS variables, Bedrock calls are refused with a message naming them.

Next steps#