Connect an Amazon Bedrock API key

Try each model once yourself

The first request to an AWS Marketplace model subscribes your account and accepts its licence. This applies to Anthropic and OpenAI models. Claude also requires a one-time use-case form. Complete these steps yourself before connecting the key.

1. In the Amazon Bedrock console, open Model catalog.
2. For each model you plan to offer, open it in the playground and send one message. For a Claude model, fill in the form it asks for first.

Your account needs a payment method AWS Marketplace accepts. AWS’s guide: access to models.

Choose the Region

A key works only in the Region it was made in. Make it in one the Keys screen lists. Tokens On Me sends requests through Bedrock’s global inference profiles, so AWS may run them in another Region, at the standard price.

Every listed Region serves Claude. GPT-6 Astra is served in fewer: when you give, a model your key’s Region does not serve is greyed out.

Create the key

1. In the Bedrock console, switched to that Region, open API keys, then the Long-term API keys tab, and choose Generate long-term API keys.
2. Choose when it expires. A shorter life is safer: you can connect a new key at any time.
3. Generate it and copy it: it starts with ABSK, and AWS shows it once.

A short-term key lasts twelve hours at most: the Keys screen refuses it.

Restrict the key’s permissions

AWS creates an IAM user for the key and attaches AmazonBedrockLimitedAccess, which allows much more than calling models. Replace it with a policy that allows only the models you will give.

1. In the IAM console, open Users and the user AWS created with the key.
2. Under Permissions, remove AmazonBedrockLimitedAccess.
3. Add an inline policy, in its JSON editor, with the contents below. Replace REGION with the key’s Region (eu-west-3, say) and ACCOUNT_ID with your account’s twelve digits, and remove the lines of models you will not give, in every statement.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "GlobalProfiles",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:REGION:ACCOUNT_ID:inference-profile/global.anthropic.claude-fable-5-1",
        "arn:aws:bedrock:REGION:ACCOUNT_ID:inference-profile/global.anthropic.claude-opus-5-5",
        "arn:aws:bedrock:REGION:ACCOUNT_ID:inference-profile/global.anthropic.claude-sonnet-5-5",
        "arn:aws:bedrock:REGION:ACCOUNT_ID:inference-profile/global.anthropic.claude-haiku-5-5",
        "arn:aws:bedrock:REGION:ACCOUNT_ID:inference-profile/global.openai.gpt-6-astra"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "REGION"
        }
      }
    },
    {
      "Sid": "ModelsInTheKeysRegion",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:REGION::foundation-model/anthropic.claude-fable-5-1",
        "arn:aws:bedrock:REGION::foundation-model/anthropic.claude-opus-5-5",
        "arn:aws:bedrock:REGION::foundation-model/anthropic.claude-sonnet-5-5",
        "arn:aws:bedrock:REGION::foundation-model/anthropic.claude-haiku-5-5",
        "arn:aws:bedrock:REGION::foundation-model/openai.gpt-6-astra"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "REGION"
        },
        "StringLike": {
          "bedrock:InferenceProfileArn": "arn:aws:bedrock:REGION:ACCOUNT_ID:inference-profile/global.*"
        }
      }
    },
    {
      "Sid": "ModelsWorldwide",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:::foundation-model/anthropic.claude-fable-5-1",
        "arn:aws:bedrock:::foundation-model/anthropic.claude-opus-5-5",
        "arn:aws:bedrock:::foundation-model/anthropic.claude-sonnet-5-5",
        "arn:aws:bedrock:::foundation-model/anthropic.claude-haiku-5-5",
        "arn:aws:bedrock:::foundation-model/openai.gpt-6-astra"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "unspecified"
        },
        "StringLike": {
          "bedrock:InferenceProfileArn": "arn:aws:bedrock:REGION:ACCOUNT_ID:inference-profile/global.*"
        }
      }
    },
    {
      "Sid": "ResponsesDefaultProject",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:REGION:ACCOUNT_ID:project/default"
      ]
    }
  ]
}

The first three statements

What AWS asks for a global inference profile: the profile in your Region, the model in your Region, and the model wherever AWS runs it, reached only through your profiles.

ResponsesDefaultProject

Only for GPT: Bedrock’s Responses API, which Codex speaks, also checks your account’s default project. Remove it if you give no GPT model.

AWS’s guide: global cross-Region inference.

Set a budget alert

AWS has no spending limit that stops requests as they happen: it updates budgets at least once a day, so an alert can come hours after the spending. Tokens On Me sets money aside on each allowance before every request, and checks that the balance can cover the reservation.

1. In AWS Budgets, create a monthly cost budget with an email alert, to help you monitor spending.

Connect it

1. Sign in, open Keys, paste the key under Amazon Bedrock, choose the Region it was made in, and save.
2. Create an allowance in Allowances and choose this provider key.

Stop access

In the IAM console, on the key’s user, deactivate or delete the key: Bedrock refuses every request made with it from then on. Disconnecting it on the Keys screen also stops new requests through this service.