How to pass JWT token to invoke_agent_runtime using boto3 bedrock-agentcore client?

Question

We have deployed a custom agent (Strands Framework)  using FastAPI and Docker to AgentCore Runtime.
We also verified the docker/arm64arch on local and /invocation endpoint is responding as expected.
We configured the AgentCore Runtime to use the JWT Identity Type with our existing IdP (OpenID Supported) and configured discovery url to .well-known config; along with clientId and Audience.

But when we are trying to invoke the agent using boto3 bedrock-agentcore client mentioned [https://github.com/awslabs/amazon-bedrock-agentcore-samples/blob/main/01-tutorials/01-AgentCore-runtime/03-advanced-concepts/05-multi-agents/01-multi-runtimes-with-boto3/orchestrator_agent/invoke_agent_utils.py]

My sample invoke agent script: (headers) **with agent runtime configured with JWT Identity **-

```
import boto3
import json

# Initialize the AgentCore Runtime client
agent_core_client = boto3.client('bedrock-agentcore', region_name='ap-southeast-2')

headers = {
    "Authorization": "Bearer ",
    "x-original-access-token":"token", # added this extra header as my agent code looks for this header.
    "Content-Type": "application/x-www-form-urlencoded" # tried "application/json" as well.
    }

payload = json.dumps({"task_type":"ask",
            "payload":{
            "question": "what is my name? "
        }})

# Invoke the agent
response = agent_core_client.invoke_agent_runtime(
    agentRuntimeArn="arn:aws:bedrock-agentcore:ap-southeast-2::runtime/", 
    runtimeSessionId="", 
    payload=payload,
    headers=headers
)
response_body = response['response'].read()
response_data = json.loads(response_body)
print("Agent Response:", response_data)

```
error with Header attribute:

```
raise ParamValidationError(report=report.generate_report())
botocore.exceptions.ParamValidationError: Parameter validation failed:
Unknown parameter in input: "headers", must be one of: contentType, accept, mcpSessionId, runtimeSessionId, mcpProtocolVersion, runtimeUserId, traceId, traceParent, traceState, baggage, agentRuntimeArn, qualifier, payload
```

Error when executed above code without Header attribute:

```
  File "/Users/pravinkalbhor/Documents/codebase/gapmaps-advisory-ai/.pixi/envs/default/lib/python3.12/site-packages/botocore/client.py", line 1078, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.errorfactory.AccessDeniedException: An error occurred (AccessDeniedException) when calling the InvokeAgentRuntime operation: Authorization method mismatch. The agent is configured for a different authorization method than what was used in your request. Check the agent's authorization configuration and ensure your request uses the matching method (OAuth or SigV4)
```

Will there be a provision in future passing JWT to agent_core_runtime client? or We have to use any other way to call the /invocation endpoint directly?

Thanks in Advance,
Pravin!

re:Post Agent · Answer

When using Amazon Bedrock AgentCore with JWT authentication, you cannot use the AWS SDK (boto3) to call `invoke_agent_runtime` directly with JWT tokens. According to the documentation, if you're integrating your agent with OAuth, you need to make an HTTPS request to `InvokeAgentRuntime` instead of using the boto3 client.

This explains why you're getting the parameter validation error when trying to pass the JWT token in the headers parameter - the boto3 client for bedrock-agentcore doesn't support passing authorization headers this way.

For agents configured with JWT authentication, you need to:

1. Make a direct HTTPS request to the InvokeAgentRuntime endpoint
2. Include your JWT token in the Authorization header
3. Format your request according to the AgentCore API requirements

Your second approach using STS/OIDC to assume a role and then using the temporary credentials with boto3 works because you're switching the authentication method to IAM (SigV4) instead of JWT. This is why you had to reconfigure your agent runtime to use IAM identity.

If you must use JWT authentication with your existing IdP and need the token available in your agent tools, you have two options:

1. Continue using the direct HTTPS request approach with JWT authentication
2. Pass the token as part of your payload data when using the boto3 client with IAM authentication, so your agent can extract and use it from the payload

The second option allows you to keep using boto3 while still making the token available to your agent, though you'd need to modify your agent code to extract the token from the payload rather than from the headers.  
**Sources**  
[invoke_agent_runtime - Boto3 1.40.3 documentation](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/bedrock-agentcore/client/invoke_agent_runtime.html)  
[How to route pass through an access token in AWS Bedrock AgentCore? | AWS re:Post](https://repost.aws/questions/QUCAGE_5rrREa7Q4Pa4YdqLQ/how-to-route-pass-through-an-access-token-in-aws-bedrock-agentcore)  
[Introducing Amazon Bedrock AgentCore Identity: Securing agentic AI at scale | Artificial Intelligence](https://aws.amazon.com/blogs/machine-learning/introducing-amazon-bedrock-agentcore-identity-securing-agentic-ai-at-scale/)

User-5635257 · Answer

In order to enable Auth Token propagation directly at the AgentCore Runtime level please consider using the custom headers feature.
Custom headers let you pass contextual information from your application directly to your agent code without cluttering the main request payload. This includes authentication tokens like JWT (JSON Web Tokens, which contain user identity and authorization claims) through the Authorization header, allowing your agent to make decisions based on who is calling it.

Source:
[https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-header-allowlist.html](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-header-allowlist.html)

How to pass JWT token to invoke_agent_runtime using boto3 bedrock-agentcore client?

Add your answer

Relevant content