From d2eb948b10c7d342eb817bf90d085df6ef0a3ace Mon Sep 17 00:00:00 2001
From: "openclaw-docs-sync[bot]"
 <openclaw-docs-sync[bot]@users.noreply.github.com>
Date: Mon, 6 Apr 2026 00:42:03 +0000
Subject: [PATCH] chore(sync): mirror docs from
 openclaw/openclaw@0793136c6361594c889e385dce06a73a0f2b3de6

---
 .openclaw-sync/source.json       |  4 ++--
 docs/providers/bedrock-mantle.md | 27 ++++++++++++++++++++-------
 2 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index 0fe704357..997a05bca 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "098f4eeebbede828e994a10c4973b4d60cf529f4",
-  "syncedAt": "2026-04-06T00:32:26.256Z"
+  "sha": "0793136c6361594c889e385dce06a73a0f2b3de6",
+  "syncedAt": "2026-04-06T00:42:02.598Z"
 }
diff --git a/docs/providers/bedrock-mantle.md b/docs/providers/bedrock-mantle.md
index 160747d27..f48bdc902 100644
--- a/docs/providers/bedrock-mantle.md
+++ b/docs/providers/bedrock-mantle.md
@@ -17,14 +17,17 @@ third-party models (GPT-OSS, Qwen, Kimi, GLM, and similar) through a standard
 
 - Provider: `amazon-bedrock-mantle`
 - API: `openai-completions` (OpenAI-compatible)
-- Auth: bearer token via `AWS_BEARER_TOKEN_BEDROCK`
+- Auth: explicit `AWS_BEARER_TOKEN_BEDROCK` or IAM credential-chain bearer-token generation
 - Region: `AWS_REGION` or `AWS_DEFAULT_REGION` (default: `us-east-1`)
 
 ## Automatic model discovery
 
-When `AWS_BEARER_TOKEN_BEDROCK` is set, OpenClaw automatically discovers
-available Mantle models by querying the region's `/v1/models` endpoint.
-Discovery results are cached for 1 hour.
+When `AWS_BEARER_TOKEN_BEDROCK` is set, OpenClaw uses it directly. Otherwise,
+OpenClaw attempts to generate a Mantle bearer token from the AWS default
+credential chain, including shared credentials/config profiles, SSO, web
+identity, and instance or task roles. It then discovers available Mantle
+models by querying the region's `/v1/models` endpoint. Discovery results are
+cached for 1 hour, and IAM-derived bearer tokens are refreshed hourly.
 
 Supported regions: `us-east-1`, `us-east-2`, `us-west-2`, `ap-northeast-1`,
 `ap-south-1`, `ap-southeast-3`, `eu-central-1`, `eu-west-1`, `eu-west-2`,
@@ -32,7 +35,9 @@ Supported regions: `us-east-1`, `us-east-2`, `us-west-2`, `ap-northeast-1`,
 
 ## Onboarding
 
-1. Set the bearer token on the **gateway host**:
+1. Choose one auth path on the **gateway host**:
+
+Explicit bearer token:
 
 ```bash
 export AWS_BEARER_TOKEN_BEDROCK="..."
@@ -40,6 +45,14 @@ export AWS_BEARER_TOKEN_BEDROCK="..."
 export AWS_REGION="us-west-2"
 ```
 
+IAM credentials:
+
+```bash
+# Any AWS SDK-compatible auth source works here, for example:
+export AWS_PROFILE="default"
+export AWS_REGION="us-west-2"
+```
+
 2. Verify models are discovered:
 
 ```bash
@@ -81,8 +94,8 @@ If you prefer explicit config instead of auto-discovery:
 
 ## Notes
 
-- Mantle requires a bearer token today. Plain IAM credentials (instance roles,
-  SSO, access keys) are not sufficient without a token.
+- OpenClaw can mint the Mantle bearer token for you from AWS SDK-compatible
+  IAM credentials when `AWS_BEARER_TOKEN_BEDROCK` is not set.
 - The bearer token is the same `AWS_BEARER_TOKEN_BEDROCK` used by the standard
   [Amazon Bedrock](/providers/bedrock) provider.
 - Reasoning support is inferred from model IDs containing patterns like