Summary

The image tool fails when the only configured provider uses auth: "aws-sdk" (Amazon Bedrock). Enterprise users authenticating via IAM credentials do not have API keys — the aws-sdk auth mode uses SigV4 signing instead.

Error

No API key resolved for provider "amazon-bedrock" (auth mode: aws-sdk).

Root Cause

The image tool resolves auth via requireApiKey (model-auth-runtime-shared), which throws if no literal API key string is available. The main chat completion path has an allowMissingApiKeyModes escape hatch that permits keyless auth for modes like aws-sdk, but the image tool code path does not use this.

Relevant code:

• dist/image-BekbXrJh.js line 4: imports requireApiKey (strict)
• dist/simple-completion-runtime-C4i8m8Bg.js line 50: has hasMissingApiKeyAllowance (permissive) — used by main LLM path but not image tool

Expected Behavior

The image tool should respect aws-sdk auth mode the same way the main completion runtime does — allowing keyless authentication when IAM credentials are available.

Environment

• OpenClaw 2026.4.15
• Provider: Amazon Bedrock (us-west-2)
• Model: us.anthropic.claude-opus-4-6-v1 (supports vision: input: ["text", "image"])
• Auth: aws-sdk (IAM via ada credentials)

Workaround

Enterprise Bedrock users can send images inline in chat (which works through the main model path) but cannot use the dedicated image tool for analysis.

Impact

Affects all enterprise users on AWS Bedrock without direct API keys (common in Amazon internal deployments).