fix: source aware api-key flag + redact api key value from logging

src/core/identity.tsx

@@ -10,21 +10,24 @@ import {
   type ListApiKeyCredentialProvidersResponse,
   type UpdateApiKeyCredentialProviderResponse,
 } from "@aws-sdk/client-bedrock-agentcore-control";
-import type { CoreIdentityClient } from "../handlers/identity/types";
+import type {
+  CoreIdentityClient,
+  CreateApiKeyCredentialProviderInput,
+  UpdateApiKeyCredentialProviderInput,
+} from "../handlers/identity/types";
 import type { AwsClients, CoreOptions } from "./types";
 import { toClientConfig } from "./utils";
 
 export class IdentityClient implements CoreIdentityClient {
   constructor(private readonly clients: AwsClients) {}
 
   async createApiKeyCredentialProvider(
-    name: string,
-    apiKey: string,
+    input: CreateApiKeyCredentialProviderInput,
     options: CoreOptions,
   ): Promise<CreateApiKeyCredentialProviderResponse> {
     return this.clients
       .control(toClientConfig(options))
-      .send(new CreateApiKeyCredentialProviderCommand({ name, apiKey }));
+      .send(new CreateApiKeyCredentialProviderCommand(input));
   }
 
   async getApiKeyCredentialProvider(
@@ -47,13 +50,12 @@ export class IdentityClient implements CoreIdentityClient {
   }
 
   async updateApiKeyCredentialProvider(
-    name: string,
-    apiKey: string,
+    input: UpdateApiKeyCredentialProviderInput,
     options: CoreOptions,
   ): Promise<UpdateApiKeyCredentialProviderResponse> {
     return this.clients
       .control(toClientConfig(options))
-      .send(new UpdateApiKeyCredentialProviderCommand({ name, apiKey }));
+      .send(new UpdateApiKeyCredentialProviderCommand(input));
   }
 
   async deleteApiKeyCredentialProvider(

src/handlers/identity/__fixtures__/CreateApiKeyCredentialProviderCommand.83b094791cea0052.json

@@ -0,0 +1,8 @@
+{
+  "apiKeySecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-21072164-GDCjeF"
+  },
+  "name": "agentcore-cli-identity-fixture",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
+  "apiKeySecretSource": "MANAGED"
+}

src/handlers/identity/__fixtures__/CreateApiKeyCredentialProviderCommand.dfed014f440c1884.json

@@ -0,0 +1,8 @@
+{
+  "apiKeySecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-2-2a7aabf1-MsSy03"
+  },
+  "name": "agentcore-cli-identity-fixture-2",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture-2",
+  "apiKeySecretSource": "MANAGED"
+}

src/handlers/identity/__fixtures__/GetApiKeyCredentialProviderCommand.b0c07380332f4673.json

@@ -1,14 +1,14 @@
 {
   "apiKeySecretArn": {
-    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-34b3f8a9-cHh41n"
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-21072164-GDCjeF"
   },
   "name": "agentcore-cli-identity-fixture",
   "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
   "createdTime": {
-    "$date": "2026-07-23T16:31:54.009Z"
+    "$date": "2026-07-24T17:00:22.115Z"
   },
   "lastUpdatedTime": {
-    "$date": "2026-07-23T16:31:54.009Z"
+    "$date": "2026-07-24T17:00:22.115Z"
   },
   "apiKeySecretSource": "MANAGED"
 }

src/handlers/identity/__fixtures__/ListApiKeyCredentialProvidersCommand.23f97c9dcdd6350b.json

@@ -4,20 +4,20 @@
       "name": "agentcore-cli-identity-fixture",
       "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
       "createdTime": {
-        "$date": "2026-07-23T16:31:54.009Z"
+        "$date": "2026-07-24T17:00:22.115Z"
       },
       "lastUpdatedTime": {
-        "$date": "2026-07-23T16:31:54.009Z"
+        "$date": "2026-07-24T17:00:22.115Z"
       }
     },
     {
       "name": "agentcore-cli-identity-fixture-2",
       "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture-2",
       "createdTime": {
-        "$date": "2026-07-23T16:31:54.309Z"
+        "$date": "2026-07-24T17:00:22.404Z"
       },
       "lastUpdatedTime": {
-        "$date": "2026-07-23T16:31:54.309Z"
+        "$date": "2026-07-24T17:00:22.404Z"
       }
     }
   ]

src/handlers/identity/__fixtures__/ListApiKeyCredentialProvidersCommand.6e1f31dcdf053d87.json

@@ -4,10 +4,10 @@
       "name": "agentcore-cli-identity-fixture-2",
       "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture-2",
       "createdTime": {
-        "$date": "2026-07-23T16:31:54.309Z"
+        "$date": "2026-07-24T17:00:22.404Z"
       },
       "lastUpdatedTime": {
-        "$date": "2026-07-23T16:31:54.309Z"
+        "$date": "2026-07-24T17:00:22.404Z"
       }
     }
   ]

src/handlers/identity/__fixtures__/ListApiKeyCredentialProvidersCommand.7d2e22c637f6b633.json

@@ -4,10 +4,10 @@
       "name": "agentcore-cli-identity-fixture",
       "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
       "createdTime": {
-        "$date": "2026-07-23T16:31:54.009Z"
+        "$date": "2026-07-24T17:00:22.115Z"
       },
       "lastUpdatedTime": {
-        "$date": "2026-07-23T16:31:54.009Z"
+        "$date": "2026-07-24T17:00:22.115Z"
       }
     }
   ],

src/handlers/identity/__fixtures__/UpdateApiKeyCredentialProviderCommand.a779aef2084d562f.json

@@ -0,0 +1,14 @@
+{
+  "apiKeySecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-21072164-GDCjeF"
+  },
+  "name": "agentcore-cli-identity-fixture",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
+  "createdTime": {
+    "$date": "2026-07-24T17:00:22.115Z"
+  },
+  "lastUpdatedTime": {
+    "$date": "2026-07-24T17:00:22.115Z"
+  },
+  "apiKeySecretSource": "MANAGED"
+}

src/handlers/identity/__fixtures__/create-2.golden.json

@@ -1,6 +1,6 @@
 {
   "apiKeySecretArn": {
-    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-2-29a3e5b6-qiRJxb"
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-2-2a7aabf1-MsSy03"
   },
   "name": "agentcore-cli-identity-fixture-2",
   "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture-2",

src/handlers/identity/__fixtures__/create.golden.json

@@ -1,6 +1,6 @@
 {
   "apiKeySecretArn": {
-    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-34b3f8a9-cHh41n"
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-21072164-GDCjeF"
   },
   "name": "agentcore-cli-identity-fixture",
   "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",

src/handlers/identity/__fixtures__/get.golden.json

@@ -1,10 +1,10 @@
 {
   "apiKeySecretArn": {
-    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-34b3f8a9-cHh41n"
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-21072164-GDCjeF"
   },
   "name": "agentcore-cli-identity-fixture",
   "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
-  "createdTime": "2026-07-23T16:31:54.009Z",
-  "lastUpdatedTime": "2026-07-23T16:31:54.009Z",
+  "createdTime": "2026-07-24T17:00:22.115Z",
+  "lastUpdatedTime": "2026-07-24T17:00:22.115Z",
   "apiKeySecretSource": "MANAGED"
 }

src/handlers/identity/__fixtures__/list-page-1.golden.json

@@ -3,8 +3,8 @@
     {
       "name": "agentcore-cli-identity-fixture",
       "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
-      "createdTime": "2026-07-23T16:31:54.009Z",
-      "lastUpdatedTime": "2026-07-23T16:31:54.009Z"
+      "createdTime": "2026-07-24T17:00:22.115Z",
+      "lastUpdatedTime": "2026-07-24T17:00:22.115Z"
     }
   ],
   "nextToken": "eyJBY2NvdW50QW5kVHlwZUdzaVBrIjp7InZhbHVlU3RyIjoiNjg1MTk3NzA4Njg3I0FQSV9LRVkiLCJhdHRyaWJ1dGVUeXBlIjoiUyJ9LCJTSyI6eyJ2YWx1ZVN0ciI6ImFnZW50Y29yZS1jbGktaWRlbnRpdHktZml4dHVyZSIsImF0dHJpYnV0ZVR5cGUiOiJTIn0sIlBLIjp7InZhbHVlU3RyIjoiQVBJX0tFWV9DUkVEX1BST1ZJREVSIzY4NTE5NzcwODY4NyNkZWZhdWx0I2FnZW50Y29yZS1jbGktaWRlbnRpdHktZml4dHVyZSIsImF0dHJpYnV0ZVR5cGUiOiJTIn19"

src/handlers/identity/__fixtures__/list-page-2.golden.json

@@ -3,8 +3,8 @@
     {
       "name": "agentcore-cli-identity-fixture-2",
       "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture-2",
-      "createdTime": "2026-07-23T16:31:54.309Z",
-      "lastUpdatedTime": "2026-07-23T16:31:54.309Z"
+      "createdTime": "2026-07-24T17:00:22.404Z",
+      "lastUpdatedTime": "2026-07-24T17:00:22.404Z"
     }
   ]
 }

src/handlers/identity/__fixtures__/list.golden.json

@@ -3,14 +3,14 @@
     {
       "name": "agentcore-cli-identity-fixture",
       "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
-      "createdTime": "2026-07-23T16:31:54.009Z",
-      "lastUpdatedTime": "2026-07-23T16:31:54.009Z"
+      "createdTime": "2026-07-24T17:00:22.115Z",
+      "lastUpdatedTime": "2026-07-24T17:00:22.115Z"
     },
     {
       "name": "agentcore-cli-identity-fixture-2",
       "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture-2",
-      "createdTime": "2026-07-23T16:31:54.309Z",
-      "lastUpdatedTime": "2026-07-23T16:31:54.309Z"
+      "createdTime": "2026-07-24T17:00:22.404Z",
+      "lastUpdatedTime": "2026-07-24T17:00:22.404Z"
     }
   ]
 }

src/handlers/identity/__fixtures__/update.golden.json

@@ -1,10 +1,10 @@
 {
   "apiKeySecretArn": {
-    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-34b3f8a9-cHh41n"
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-21072164-GDCjeF"
   },
   "name": "agentcore-cli-identity-fixture",
   "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
-  "createdTime": "2026-07-23T16:31:54.009Z",
-  "lastUpdatedTime": "2026-07-23T16:31:54.009Z",
+  "createdTime": "2026-07-24T17:00:22.115Z",
+  "lastUpdatedTime": "2026-07-24T17:00:22.115Z",
   "apiKeySecretSource": "MANAGED"
 }

src/handlers/identity/api-key-credential-provider/create/index.tsx

@@ -1,33 +1,60 @@
 import z from "zod";
 import { createHandler, flag } from "../../../../router";
 import { JsonRendererKey } from "../../../../tui";
-import type { Core } from "../../../types";
-import { coreOptsFromCtx } from "../../../utils";
+import type { AppIO, Core } from "../../../types";
+import { coreOptsFromCtx, parseTags } from "../../../utils";
+import { readSourceText } from "../../../source";
+import { parseSecretReference } from "../parser";
 
-export const createCreateApiKeyCredentialProviderHandler = (core: Core) =>
+export const createCreateApiKeyCredentialProviderHandler = (core: Core, io: AppIO) =>
   createHandler({
     name: "create",
     description: "create an API key credential provider",
     flags: [
       flag("name", "the name of the API key credential provider", z.string().optional()),
-      flag("api-key", "the API key value", z.string().optional()),
+      flag("api-key", "the API key value (inline, file://path, or -)", z.string().optional(), {
+        sensitive: true,
+      }),
+      flag(
+        "api-key-secret-reference",
+        'external secret reference JSON: {"secretId":"<arn>","jsonKey":"<key>"}',
+        z.string().optional(),
+      ),
+      flag("tags", "tags as key=value (repeatable) or JSON object", z.array(z.string()).optional()),
     ],
     handle: async (ctx, flags) => {
       if (!flags.name) {
         throw new TypeError("required option '--name <name>' not specified");
       }
-      if (!flags["api-key"]) {
-        throw new TypeError("required option '--api-key <api-key>' not specified");
+
+      const hasApiKey = flags["api-key"] !== undefined;
+      const hasSecretRef = flags["api-key-secret-reference"] !== undefined;
+
+      if (hasApiKey && hasSecretRef) {
+        throw new TypeError("--api-key and --api-key-secret-reference are mutually exclusive");
       }
+      if (!hasApiKey && !hasSecretRef) {
+        throw new TypeError("either --api-key or --api-key-secret-reference is required");
+      }
+
+      const apiKey = hasApiKey ? await readSourceText(flags["api-key"]!, io.stdin) : undefined;
+      const apiKeySecretConfig = hasSecretRef
+        ? parseSecretReference(flags["api-key-secret-reference"]!)
+        : undefined;
+      const apiKeySecretSource = hasApiKey ? "MANAGED" : "EXTERNAL";
+      const tags = parseTags(flags.tags);
 
-      ctx
-        .require(JsonRendererKey)
-        .renderJson(
-          await core.identity.createApiKeyCredentialProvider(
-            flags.name,
-            flags["api-key"],
-            coreOptsFromCtx(ctx),
-          ),
-        );
+      ctx.require(JsonRendererKey).renderJson(
+        await core.identity.createApiKeyCredentialProvider(
+          {
+            name: flags.name,
+            apiKey,
+            apiKeySecretConfig,
+            apiKeySecretSource: apiKeySecretSource as any,
+            tags,
+          },
+          coreOptsFromCtx(ctx),
+        ),
+      );
     },
   });

src/handlers/identity/api-key-credential-provider/index.tsx

@@ -10,9 +10,9 @@ import { createUpdateApiKeyCredentialProviderHandler } from "./update";
 export function createApiKeyCredentialProviderHandler(core: Core, io: AppIO): Router {
   return new Router("api-key-credential-provider", "manage API key credential providers")
     .default(createHelpDefault(io))
-    .handler(createCreateApiKeyCredentialProviderHandler(core))
+    .handler(createCreateApiKeyCredentialProviderHandler(core, io))
     .handler(createGetApiKeyCredentialProviderHandler(core))
     .handler(createListApiKeyCredentialProvidersHandler(core))
-    .handler(createUpdateApiKeyCredentialProviderHandler(core))
+    .handler(createUpdateApiKeyCredentialProviderHandler(core, io))
     .handler(createDeleteApiKeyCredentialProviderHandler(core));
 }