feat(identity): add identity scaffolding and CRUDL operations for api key

src/components/RouterScreen.test.tsx

@@ -87,6 +87,9 @@ describe("navigation", () => {
     const r = renderScreen("/agentcore");
     await waitForText(r.lastFrame, "❯ harness");
 
+    await r.press("down");
+    await waitForText(r.lastFrame, "❯ identity");
+
     await r.press("down");
     await waitForText(r.lastFrame, "❯ runtime");
     r.unmount();

src/core/identity.tsx

@@ -0,0 +1,67 @@
+import {
+  CreateApiKeyCredentialProviderCommand,
+  DeleteApiKeyCredentialProviderCommand,
+  GetApiKeyCredentialProviderCommand,
+  ListApiKeyCredentialProvidersCommand,
+  UpdateApiKeyCredentialProviderCommand,
+  type CreateApiKeyCredentialProviderResponse,
+  type DeleteApiKeyCredentialProviderResponse,
+  type GetApiKeyCredentialProviderResponse,
+  type ListApiKeyCredentialProvidersResponse,
+  type UpdateApiKeyCredentialProviderResponse,
+} from "@aws-sdk/client-bedrock-agentcore-control";
+import type { CoreIdentityClient } from "../handlers/identity/types";
+import type { AwsClients, CoreOptions } from "./types";
+import { toClientConfig } from "./utils";
+
+export class IdentityClient implements CoreIdentityClient {
+  constructor(private readonly clients: AwsClients) {}
+
+  async createApiKeyCredentialProvider(
+    name: string,
+    apiKey: string,
+    options: CoreOptions,
+  ): Promise<CreateApiKeyCredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new CreateApiKeyCredentialProviderCommand({ name, apiKey }));
+  }
+
+  async getApiKeyCredentialProvider(
+    name: string,
+    options: CoreOptions,
+  ): Promise<GetApiKeyCredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new GetApiKeyCredentialProviderCommand({ name }));
+  }
+
+  async listApiKeyCredentialProviders(
+    nextToken: string | undefined,
+    maxResults: number | undefined,
+    options: CoreOptions,
+  ): Promise<ListApiKeyCredentialProvidersResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new ListApiKeyCredentialProvidersCommand({ nextToken, maxResults }));
+  }
+
+  async updateApiKeyCredentialProvider(
+    name: string,
+    apiKey: string,
+    options: CoreOptions,
+  ): Promise<UpdateApiKeyCredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new UpdateApiKeyCredentialProviderCommand({ name, apiKey }));
+  }
+
+  async deleteApiKeyCredentialProvider(
+    name: string,
+    options: CoreOptions,
+  ): Promise<DeleteApiKeyCredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new DeleteApiKeyCredentialProviderCommand({ name }));
+  }
+}

src/core/index.tsx

@@ -2,6 +2,7 @@ import { BedrockAgentCoreControlClient } from "@aws-sdk/client-bedrock-agentcore
 import { BedrockAgentCoreClient } from "@aws-sdk/client-bedrock-agentcore";
 import { IAMClient } from "@aws-sdk/client-iam";
 import { HarnessClient } from "./harness";
+import { IdentityClient } from "./identity";
 import { RuntimeClient } from "./runtime";
 import type {
   AwsClients,
@@ -45,6 +46,7 @@ export class CoreClient implements AwsClients {
 
   // Feature-scoped sub-clients. Access as e.g. `coreClient.harness.getHarness(...)`.
   readonly harness: HarnessClient = new HarnessClient(this);
+  readonly identity: IdentityClient = new IdentityClient(this);
   readonly runtime: RuntimeClient = new RuntimeClient(this);
 
   readonly projectManager: ProjectManager;

src/handlers/runtime/help.tsx → src/handlers/help.tsx

@@ -1,5 +1,5 @@
-import { CommandKey, type DefaultHandle } from "../../router";
-import type { AppIO } from "../types";
+import { CommandKey, type DefaultHandle } from "../router";
+import type { AppIO } from "./types";
 
 export function createHelpDefault(io: AppIO): DefaultHandle {
   return async (ctx) => {

src/handlers/identity/__fixtures__/CreateApiKeyCredentialProviderCommand.14ae02cc9ee2a0c.json

@@ -0,0 +1,8 @@
+{
+  "apiKeySecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:314146320088:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-2-7fd24230-KEL3mK"
+  },
+  "name": "agentcore-cli-identity-fixture-2",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture-2",
+  "apiKeySecretSource": "MANAGED"
+}

src/handlers/identity/__fixtures__/CreateApiKeyCredentialProviderCommand.c9fb3278285e2c1a.json

@@ -0,0 +1,8 @@
+{
+  "apiKeySecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:314146320088:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-d831a6a9-5GBOcy"
+  },
+  "name": "agentcore-cli-identity-fixture",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
+  "apiKeySecretSource": "MANAGED"
+}

src/handlers/identity/__fixtures__/DeleteApiKeyCredentialProviderCommand.18249011246bc648.json

@@ -0,0 +1 @@
+{}

src/handlers/identity/__fixtures__/DeleteApiKeyCredentialProviderCommand.b0c07380332f4673.json

@@ -0,0 +1 @@
+{}

src/handlers/identity/__fixtures__/GetApiKeyCredentialProviderCommand.b0c07380332f4673.json

@@ -0,0 +1,14 @@
+{
+  "apiKeySecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:314146320088:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-d831a6a9-5GBOcy"
+  },
+  "name": "agentcore-cli-identity-fixture",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
+  "createdTime": {
+    "$date": "2026-07-22T18:56:27.969Z"
+  },
+  "lastUpdatedTime": {
+    "$date": "2026-07-22T18:56:27.969Z"
+  },
+  "apiKeySecretSource": "MANAGED"
+}

src/handlers/identity/__fixtures__/GetApiKeyCredentialProviderCommand.e134007136f7ab2.json

@@ -0,0 +1,6 @@
+{
+  "$error": {
+    "name": "ResourceNotFoundException",
+    "message": "ApiKeyCredentialProvider not found for missing-provider-000"
+  }
+}

src/handlers/identity/__fixtures__/ListApiKeyCredentialProvidersCommand.23f97c9dcdd6350b.json

@@ -0,0 +1,24 @@
+{
+  "credentialProviders": [
+    {
+      "name": "agentcore-cli-identity-fixture",
+      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
+      "createdTime": {
+        "$date": "2026-07-22T18:56:27.969Z"
+      },
+      "lastUpdatedTime": {
+        "$date": "2026-07-22T18:56:27.969Z"
+      }
+    },
+    {
+      "name": "agentcore-cli-identity-fixture-2",
+      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture-2",
+      "createdTime": {
+        "$date": "2026-07-22T18:56:28.265Z"
+      },
+      "lastUpdatedTime": {
+        "$date": "2026-07-22T18:56:28.265Z"
+      }
+    }
+  ]
+}

src/handlers/identity/__fixtures__/ListApiKeyCredentialProvidersCommand.7386ccbbc3fc09a4.json

@@ -0,0 +1,14 @@
+{
+  "credentialProviders": [
+    {
+      "name": "agentcore-cli-identity-fixture-2",
+      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture-2",
+      "createdTime": {
+        "$date": "2026-07-22T18:56:28.265Z"
+      },
+      "lastUpdatedTime": {
+        "$date": "2026-07-22T18:56:28.265Z"
+      }
+    }
+  ]
+}

src/handlers/identity/__fixtures__/ListApiKeyCredentialProvidersCommand.7d2e22c637f6b633.json

@@ -0,0 +1,15 @@
+{
+  "credentialProviders": [
+    {
+      "name": "agentcore-cli-identity-fixture",
+      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
+      "createdTime": {
+        "$date": "2026-07-22T18:56:27.969Z"
+      },
+      "lastUpdatedTime": {
+        "$date": "2026-07-22T18:56:27.969Z"
+      }
+    }
+  ],
+  "nextToken": "eyJBY2NvdW50QW5kVHlwZUdzaVBrIjp7InZhbHVlU3RyIjoiMzE0MTQ2MzIwMDg4I0FQSV9LRVkiLCJhdHRyaWJ1dGVUeXBlIjoiUyJ9LCJTSyI6eyJ2YWx1ZVN0ciI6ImFnZW50Y29yZS1jbGktaWRlbnRpdHktZml4dHVyZSIsImF0dHJpYnV0ZVR5cGUiOiJTIn0sIlBLIjp7InZhbHVlU3RyIjoiQVBJX0tFWV9DUkVEX1BST1ZJREVSIzMxNDE0NjMyMDA4OCNkZWZhdWx0I2FnZW50Y29yZS1jbGktaWRlbnRpdHktZml4dHVyZSIsImF0dHJpYnV0ZVR5cGUiOiJTIn19"
+}

src/handlers/identity/__fixtures__/UpdateApiKeyCredentialProviderCommand.68e4cd8243ce33f4.json

@@ -0,0 +1,14 @@
+{
+  "apiKeySecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:314146320088:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-d831a6a9-5GBOcy"
+  },
+  "name": "agentcore-cli-identity-fixture",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
+  "createdTime": {
+    "$date": "2026-07-22T18:56:27.969Z"
+  },
+  "lastUpdatedTime": {
+    "$date": "2026-07-22T18:56:27.969Z"
+  },
+  "apiKeySecretSource": "MANAGED"
+}

src/handlers/identity/__fixtures__/create-2.golden.json

@@ -0,0 +1,8 @@
+{
+  "apiKeySecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:314146320088:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-2-7fd24230-KEL3mK"
+  },
+  "name": "agentcore-cli-identity-fixture-2",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture-2",
+  "apiKeySecretSource": "MANAGED"
+}

src/handlers/identity/__fixtures__/create.golden.json

@@ -0,0 +1,8 @@
+{
+  "apiKeySecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:314146320088:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-d831a6a9-5GBOcy"
+  },
+  "name": "agentcore-cli-identity-fixture",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
+  "apiKeySecretSource": "MANAGED"
+}

src/handlers/identity/__fixtures__/delete-2.golden.json

@@ -0,0 +1 @@
+{}

src/handlers/identity/__fixtures__/delete.golden.json

@@ -0,0 +1 @@
+{}

src/handlers/identity/__fixtures__/get.golden.json

@@ -0,0 +1,10 @@
+{
+  "apiKeySecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:314146320088:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-d831a6a9-5GBOcy"
+  },
+  "name": "agentcore-cli-identity-fixture",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
+  "createdTime": "2026-07-22T18:56:27.969Z",
+  "lastUpdatedTime": "2026-07-22T18:56:27.969Z",
+  "apiKeySecretSource": "MANAGED"
+}

src/handlers/identity/__fixtures__/list-page-1.golden.json

@@ -0,0 +1,11 @@
+{
+  "credentialProviders": [
+    {
+      "name": "agentcore-cli-identity-fixture",
+      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
+      "createdTime": "2026-07-22T18:56:27.969Z",
+      "lastUpdatedTime": "2026-07-22T18:56:27.969Z"
+    }
+  ],
+  "nextToken": "eyJBY2NvdW50QW5kVHlwZUdzaVBrIjp7InZhbHVlU3RyIjoiMzE0MTQ2MzIwMDg4I0FQSV9LRVkiLCJhdHRyaWJ1dGVUeXBlIjoiUyJ9LCJTSyI6eyJ2YWx1ZVN0ciI6ImFnZW50Y29yZS1jbGktaWRlbnRpdHktZml4dHVyZSIsImF0dHJpYnV0ZVR5cGUiOiJTIn0sIlBLIjp7InZhbHVlU3RyIjoiQVBJX0tFWV9DUkVEX1BST1ZJREVSIzMxNDE0NjMyMDA4OCNkZWZhdWx0I2FnZW50Y29yZS1jbGktaWRlbnRpdHktZml4dHVyZSIsImF0dHJpYnV0ZVR5cGUiOiJTIn19"
+}

src/handlers/identity/__fixtures__/list-page-2.golden.json

@@ -0,0 +1,10 @@
+{
+  "credentialProviders": [
+    {
+      "name": "agentcore-cli-identity-fixture-2",
+      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture-2",
+      "createdTime": "2026-07-22T18:56:28.265Z",
+      "lastUpdatedTime": "2026-07-22T18:56:28.265Z"
+    }
+  ]
+}

src/handlers/identity/__fixtures__/list.golden.json

@@ -0,0 +1,16 @@
+{
+  "credentialProviders": [
+    {
+      "name": "agentcore-cli-identity-fixture",
+      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
+      "createdTime": "2026-07-22T18:56:27.969Z",
+      "lastUpdatedTime": "2026-07-22T18:56:27.969Z"
+    },
+    {
+      "name": "agentcore-cli-identity-fixture-2",
+      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture-2",
+      "createdTime": "2026-07-22T18:56:28.265Z",
+      "lastUpdatedTime": "2026-07-22T18:56:28.265Z"
+    }
+  ]
+}

src/handlers/identity/__fixtures__/update.golden.json

@@ -0,0 +1,10 @@
+{
+  "apiKeySecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:314146320088:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-d831a6a9-5GBOcy"
+  },
+  "name": "agentcore-cli-identity-fixture",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:314146320088:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
+  "createdTime": "2026-07-22T18:56:27.969Z",
+  "lastUpdatedTime": "2026-07-22T18:56:27.969Z",
+  "apiKeySecretSource": "MANAGED"
+}

src/handlers/identity/api-key-credential-provider/create/index.tsx

@@ -0,0 +1,33 @@
+import z from "zod";
+import { createHandler, flag } from "../../../../router";
+import { JsonRendererKey } from "../../../../tui";
+import type { Core } from "../../../types";
+import { coreOptsFromCtx } from "../../../utils";
+
+export const createCreateApiKeyCredentialProviderHandler = (core: Core) =>
+  createHandler({
+    name: "create",
+    description: "create an API key credential provider",
+    flags: [
+      flag("name", "the name of the API key credential provider", z.string().optional()),
+      flag("api-key", "the API key value", z.string().optional()),
+    ],
+    handle: async (ctx, flags) => {
+      if (!flags.name) {
+        throw new TypeError("required option '--name <name>' not specified");
+      }
+      if (!flags["api-key"]) {
+        throw new TypeError("required option '--api-key <api-key>' not specified");
+      }
+
+      ctx
+        .require(JsonRendererKey)
+        .renderJson(
+          await core.identity.createApiKeyCredentialProvider(
+            flags.name,
+            flags["api-key"],
+            coreOptsFromCtx(ctx),
+          ),
+        );
+    },
+  });

src/handlers/identity/api-key-credential-provider/delete/index.tsx

@@ -0,0 +1,23 @@
+import z from "zod";
+import { createHandler, flag } from "../../../../router";
+import { JsonRendererKey } from "../../../../tui";
+import type { Core } from "../../../types";
+import { coreOptsFromCtx } from "../../../utils";
+
+export const createDeleteApiKeyCredentialProviderHandler = (core: Core) =>
+  createHandler({
+    name: "delete",
+    description: "delete an API key credential provider",
+    flags: [flag("name", "the name of the API key credential provider", z.string().optional())],
+    handle: async (ctx, flags) => {
+      if (!flags.name) {
+        throw new TypeError("required option '--name <name>' not specified");
+      }
+
+      ctx
+        .require(JsonRendererKey)
+        .renderJson(
+          await core.identity.deleteApiKeyCredentialProvider(flags.name, coreOptsFromCtx(ctx)),
+        );
+    },
+  });