diff --git a/src/anthropic/lib/aws/_client.py b/src/anthropic/lib/aws/_client.py index 31d577124..009a195fe 100644 --- a/src/anthropic/lib/aws/_client.py +++ b/src/anthropic/lib/aws/_client.py @@ -136,6 +136,16 @@ def _api_key_auth(self) -> dict[str, str]: return {} return super()._api_key_auth + @property + @override + def _bearer_auth(self) -> dict[str, str]: + # skip_auth must also silence ambient bearer credentials: the parent + # constructor falls back to ANTHROPIC_AUTH_TOKEN from the environment, + # and a leaked Authorization header defeats the point of skip_auth. + if self._skip_auth: + return {} + return super()._bearer_auth + @override def _validate_headers(self, headers: httpx.Headers, omitted: frozenset[str]) -> None: if self._use_sigv4 or self._skip_auth: @@ -344,6 +354,16 @@ def _api_key_auth(self) -> dict[str, str]: return {} return super()._api_key_auth + @property + @override + def _bearer_auth(self) -> dict[str, str]: + # skip_auth must also silence ambient bearer credentials: the parent + # constructor falls back to ANTHROPIC_AUTH_TOKEN from the environment, + # and a leaked Authorization header defeats the point of skip_auth. + if self._skip_auth: + return {} + return super()._bearer_auth + @override def _validate_headers(self, headers: httpx.Headers, omitted: frozenset[str]) -> None: if self._use_sigv4 or self._skip_auth: