feat(identity): add identity scaffolding and CRUDL operations for api key (#1811)

* feat(identity): add identity scaffolding and CRUDL operations for api key

* fix: update identity test fixture to match new CoreClient signature

* fix: update fixtures with write account plus README additions

Author: nborges-aws

README.md

@@ -49,6 +49,13 @@ agentcore                          # interactive TUI
 │       ├── list
 │       ├── update
 │       └── delete
+├── identity                       # manage AgentCore Identity resources
+│   └── api-key-credential-provider
+│       ├── create                 # create an API key credential provider
+│       ├── get                    # get an API key credential provider
+│       ├── list                   # list API key credential providers
+│       ├── update                 # update an API key credential provider
+│       └── delete                 # delete an API key credential provider
 ├── runtime                        # inspect deployed AgentCore Runtimes
 │   ├── get                        # fetch a Runtime by id
 │   ├── list                       # list Runtimes (server-side paginated)
@@ -101,6 +108,13 @@ agentcore runtime version get --id <runtimeId> --version <version>
 agentcore runtime version list --id <runtimeId> --max-results 20
 agentcore runtime endpoint get --id <runtimeId> --qualifier DEFAULT
 agentcore runtime endpoint list --id <runtimeId> --max-results 20
+
+# Manage API key credential providers
+agentcore identity api-key-credential-provider create --name my-provider --api-key <key>
+agentcore identity api-key-credential-provider get --name my-provider
+agentcore identity api-key-credential-provider list --max-results 10
+agentcore identity api-key-credential-provider update --name my-provider --api-key <new-key>
+agentcore identity api-key-credential-provider delete --name my-provider
 ```
 
 ---

src/components/RouterScreen.test.tsx

@@ -87,6 +87,9 @@ describe("navigation", () => {
     const r = renderScreen("/agentcore");
     await waitForText(r.lastFrame, "❯ harness");
 
+    await r.press("down");
+    await waitForText(r.lastFrame, "❯ identity");
+
     await r.press("down");
     await waitForText(r.lastFrame, "❯ runtime");
     r.unmount();

src/core/identity.tsx

@@ -0,0 +1,67 @@
+import {
+  CreateApiKeyCredentialProviderCommand,
+  DeleteApiKeyCredentialProviderCommand,
+  GetApiKeyCredentialProviderCommand,
+  ListApiKeyCredentialProvidersCommand,
+  UpdateApiKeyCredentialProviderCommand,
+  type CreateApiKeyCredentialProviderResponse,
+  type DeleteApiKeyCredentialProviderResponse,
+  type GetApiKeyCredentialProviderResponse,
+  type ListApiKeyCredentialProvidersResponse,
+  type UpdateApiKeyCredentialProviderResponse,
+} from "@aws-sdk/client-bedrock-agentcore-control";
+import type { CoreIdentityClient } from "../handlers/identity/types";
+import type { AwsClients, CoreOptions } from "./types";
+import { toClientConfig } from "./utils";
+
+export class IdentityClient implements CoreIdentityClient {
+  constructor(private readonly clients: AwsClients) {}
+
+  async createApiKeyCredentialProvider(
+    name: string,
+    apiKey: string,
+    options: CoreOptions,
+  ): Promise<CreateApiKeyCredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new CreateApiKeyCredentialProviderCommand({ name, apiKey }));
+  }
+
+  async getApiKeyCredentialProvider(
+    name: string,
+    options: CoreOptions,
+  ): Promise<GetApiKeyCredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new GetApiKeyCredentialProviderCommand({ name }));
+  }
+
+  async listApiKeyCredentialProviders(
+    nextToken: string | undefined,
+    maxResults: number | undefined,
+    options: CoreOptions,
+  ): Promise<ListApiKeyCredentialProvidersResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new ListApiKeyCredentialProvidersCommand({ nextToken, maxResults }));
+  }
+
+  async updateApiKeyCredentialProvider(
+    name: string,
+    apiKey: string,
+    options: CoreOptions,
+  ): Promise<UpdateApiKeyCredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new UpdateApiKeyCredentialProviderCommand({ name, apiKey }));
+  }
+
+  async deleteApiKeyCredentialProvider(
+    name: string,
+    options: CoreOptions,
+  ): Promise<DeleteApiKeyCredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new DeleteApiKeyCredentialProviderCommand({ name }));
+  }
+}

src/core/index.tsx

@@ -2,6 +2,7 @@ import { BedrockAgentCoreControlClient } from "@aws-sdk/client-bedrock-agentcore
 import { BedrockAgentCoreClient } from "@aws-sdk/client-bedrock-agentcore";
 import { IAMClient } from "@aws-sdk/client-iam";
 import { HarnessClient } from "./harness";
+import { IdentityClient } from "./identity";
 import { RuntimeClient } from "./runtime";
 import type {
   AwsClients,
@@ -45,6 +46,7 @@ export class CoreClient implements AwsClients {
 
   // Feature-scoped sub-clients. Access as e.g. `coreClient.harness.getHarness(...)`.
   readonly harness: HarnessClient = new HarnessClient(this);
+  readonly identity: IdentityClient = new IdentityClient(this);
   readonly runtime: RuntimeClient = new RuntimeClient(this);
 
   readonly projectManager: ProjectManager;

src/handlers/runtime/help.tsx src/handlers/help.tsxsrc/handlers/runtime/help.tsx renamed to src/handlers/help.tsx

@@ -1,5 +1,5 @@
-import { CommandKey, type DefaultHandle } from "../../router";
-import type { AppIO } from "../types";
+import { CommandKey, type DefaultHandle } from "../router";
+import type { AppIO } from "./types";
 
 export function createHelpDefault(io: AppIO): DefaultHandle {
   return async (ctx) => {

src/handlers/identity/__fixtures__/CreateApiKeyCredentialProviderCommand.14ae02cc9ee2a0c.json

@@ -0,0 +1,8 @@
+{
+  "apiKeySecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-2-29a3e5b6-qiRJxb"
+  },
+  "name": "agentcore-cli-identity-fixture-2",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture-2",
+  "apiKeySecretSource": "MANAGED"
+}

src/handlers/identity/__fixtures__/CreateApiKeyCredentialProviderCommand.c9fb3278285e2c1a.json

@@ -0,0 +1,8 @@
+{
+  "apiKeySecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-34b3f8a9-cHh41n"
+  },
+  "name": "agentcore-cli-identity-fixture",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
+  "apiKeySecretSource": "MANAGED"
+}

src/handlers/identity/__fixtures__/DeleteApiKeyCredentialProviderCommand.18249011246bc648.json

@@ -0,0 +1 @@
+{}

src/handlers/identity/__fixtures__/DeleteApiKeyCredentialProviderCommand.b0c07380332f4673.json

@@ -0,0 +1 @@
+{}

src/handlers/identity/__fixtures__/GetApiKeyCredentialProviderCommand.b0c07380332f4673.json

@@ -0,0 +1,14 @@
+{
+  "apiKeySecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/apikey/agentcore-cli-identity-fixture-34b3f8a9-cHh41n"
+  },
+  "name": "agentcore-cli-identity-fixture",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/apikeycredentialprovider/agentcore-cli-identity-fixture",
+  "createdTime": {
+    "$date": "2026-07-23T16:31:54.009Z"
+  },
+  "lastUpdatedTime": {
+    "$date": "2026-07-23T16:31:54.009Z"
+  },
+  "apiKeySecretSource": "MANAGED"
+}