# `ReqManagedAgents.AgentCore.SigV4`
[🔗](https://github.com/cash-mckeeman/req_managed_agents/blob/v0.12.0/req_managed_agents/lib/req_managed_agents/agent_core/sig_v4.ex#L1)

SigV4 request signing for the `bedrock-agentcore` AWS service, reusing the
`:ex_aws_auth` signer. The signer is service-parameterized, so the same call
signs both the data plane (`bedrock-agentcore.<region>`) and the control plane
(`bedrock-agentcore-control.<region>`) — pass `service: "bedrock-agentcore"`.

Infra-agnostic: credentials come from the caller or ENV; nothing here knows
about any particular endpoint behind the URL.

# `creds`

```elixir
@type creds() :: %{
  access_key_id: String.t(),
  secret_access_key: String.t(),
  region: String.t(),
  security_token: String.t() | nil
}
```

# `from_env`

```elixir
@spec from_env(keyword()) :: creds()
```

Resolve credentials from `opts`, application env, or the standard AWS_*
env vars (session-token aware). Called with no args by default, so plain
`from_env()` callers keep working unchanged.

# `sign_request`

```elixir
@spec sign_request(atom(), String.t(), iodata(), keyword()) :: [
  {String.t(), String.t()}
]
```

Return the signed header list for `method`/`url`/`body`. Caller attaches these
to the request. `:credentials` defaults to `from_env/1`; `:service` defaults to
`"bedrock-agentcore"`; `:headers` are base headers folded into the canonical set.

Returns a list of `{header_name, header_value}` tuples. The `authorization` and
`x-amz-date` headers are always present; `x-amz-security-token` is included when
a `security_token` is set in the credentials.

---

*Consult [api-reference.md](api-reference.md) for complete listing*