Client Configuration & Middleware

Relevant source files

The following files were used as context for generating this wiki page:

• internal/awsauth/awsauth.go
• aws/aws_test.go
• README.md
• examples/bedrock-bearer-token/main.go
• examples/vertex/main.go
• betamessagebatch.go

The Anthropic Go SDK provides a flexible configuration system designed to support multiple authentication methods and cloud providers including direct Anthropic API access, Amazon Bedrock, and Google Vertex AI. The architecture relies on a robust middleware system to handle request signing (specifically AWS SigV4) and environment-based configuration resolution.

Configuration is primarily handled through the option package, allowing developers to set API keys, base URLs, and custom headers. For cloud-hosted versions of Claude, specialized auth modules in the internal/awsauth and vertex packages provide the necessary logic to bridge standard Go HTTP requests with provider-specific security requirements.

Client Initialization & Options

The base client is initialized using anthropic.NewClient(), which accepts a variadic list of option.RequestOption functions. These options allow for granular control over the client's behavior, including setting the API key, defining a custom base URL, or adding global middlewares.

Standard Configuration Options

Option	Description	Source
WithAPIKey	Sets the Anthropic API key. Defaults to ANTHROPIC_API_KEY environment variable.	README.md:28
WithBaseURL	Overrides the default API endpoint.	betamessage_test.go:28
WithHeader	Adds a custom HTTP header to all outgoing requests.	internal/awsauth/awsauth.go:235
WithMiddleware	Injects a custom function into the request/response lifecycle.	internal/awsauth/awsauth.go:242

AWS Authentication & SigV4 Middleware

For integrations with AWS-based services (like Amazon Bedrock), the SDK utilizes a specialized authentication layer. This layer resolves AWS credentials and applies Signature Version 4 (SigV4) signing to outgoing HTTP requests via middleware.

Configuration Resolution

The ResolveConfig function determine the final configuration by checking explicit fields in ClientConfig followed by various environment variable fallbacks.

SigV4 Signing Logic

The SigV4Middleware captures the request body, generates a SHA256 hash, and uses the AWS SDK's signer to add the required Authorization, X-Amz-Date, and X-Amz-Security-Token headers. It also implements body replaying to ensure compatibility with the SDK's internal retry mechanisms.

Step	Action	Logic
1	Body Capture	Reads r.Body into a byte slice to allow hashing and replaying.
2	Body Replayer	Sets r.GetBody to a function that seeks a new reader to position 0.
3	Hashing	Computes sha256.Sum256(body).
4	Signing	Calls signer.SignHTTP with credentials, hash, service name, and region.

Sources: internal/awsauth/awsauth.go:173-214, aws/aws_test.go:246-270

Cloud Provider Integrations

The SDK provides specific helpers for different cloud environments, allowing Claude to be used seamlessly within existing cloud infrastructures.

Amazon Bedrock Configuration

Bedrock support is configured using bedrock.WithLoadDefaultConfig or by providing an explicit aws.Config. It can use either standard AWS IAM credentials (via SigV4) or bearer tokens.

• Bearer Token: Configured using bedrock.NewStaticBearerTokenProvider.
• IAM/SigV4: Automatically resolved from the environment (e.g., AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY).

Sources: examples/bedrock-bearer-token/main.go:13-25, internal/awsauth/awsauth.go:142-167

Google Vertex AI Configuration

Vertex AI integration utilizes Google's authentication framework. The vertex.WithGoogleAuth option configures the client with the necessary project ID and region.

client := anthropic.NewClient(
    vertex.WithGoogleAuth(context.Background(), "us-central1", "my-project-id"),
)

Sources: examples/vertex/main.go:14-16

Beta Feature Headers

The SDK manages beta features (such as Message Batches or Computer Use) by injecting specific anthropic-beta headers into requests. Some services, like the BetaMessageBatchService, automatically append the required version headers for the specific beta being used.

Summary

The Client Configuration and Middleware system provides a unified interface for accessing Claude across multiple platforms. By abstracting the complexities of AWS SigV4 signing and Google Auth into middleware, the SDK allows developers to switch between direct API access and cloud providers like Bedrock or Vertex by simply changing the client initialization options. The internal awsauth package serves as a critical bridge, handling environment variable resolution and robust request signing logic.