AWS Bedrock

Parleq delegates to your AWS CLI session — once you've signed in via aws sso login, Parleq picks up the credentials automatically and refreshes them on schedule via Soto's SSO provider. No keys to paste, no secrets to rotate.

First-time setup (one-shot):

aws configure sso
# Walk through the prompts: SSO start URL, region, IAM role, profile name.
# Pick a profile name you'll remember — e.g. "work" or "parleq".

aws sso login --profile work
# Opens a browser, completes the SSO challenge, caches a session
# in ~/.aws/sso/cache.

Then in Parleq's Setup Wizard, pick AWS Bedrock, set the Region (defaults to us-east-2), and the Profile name you used above. Click Continue, then Finish & Restart.

When the SSO session expires (typically 8–12 hours), the surfaced error in the overlay tells you exactly which command to re-run — usually aws sso login --profile <name>.

Useful when you don't have SSO — for personal AWS accounts or org accounts that still use IAM users. Keys are stored in the macOS Keychain and never written to ~/.parleq/config.json.

Create an IAM user (or use an existing one) with at minimum the following inline policy. Parleq only ever calls bedrock:InvokeModelWithResponseStream:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "*"
    }
  ]
}

Generate an access key for the user (IAM console → Users → your user → Security credentials → Create access key), then in Parleq open Settings… → Cleanup provider → AWS Bedrock, switch Auth mode to Static credentials, and paste:

• Access key ID (starts with AKIA for IAM users or ASIA for STS sessions)
• Secret access key
• Session token (only if you're using a temporary STS credential — leave blank for a permanent IAM access key)

The wizard hardcodes SSO; the static-credentials path is only available in Settings post-setup. There's no Restart needed when only the credentials change.

AWS introduced scoped Bedrock-only API keys in 2024 — a Bearer token that authenticates against Bedrock specifically, with no broader IAM reach. Parleq's BedrockBearerProvider talks to Bedrock over plain HTTPS with Authorization: Bearer <key>, bypassing SigV4 entirely. Useful when you want to give Parleq a credential that only calls Bedrock — no S3, no IAM, no other services.

Generate one in the AWS console under Bedrock → API keys. Pick a sensible expiration (e.g. 30 / 90 days) and scope it to the region(s) you'll use.

In Parleq, open Settings… → Cleanup provider → AWS Bedrock, switch Auth mode to Bedrock API key, and paste the key. Stored in the macOS Keychain.

Bedrock API keys expire on the date you set when creating them — Parleq's error surface includes the auth-mode hint, so an expired key shows up clearly. Generate a new one and replace it in Settings; no restart needed.

Two recommended options, picked from in-house benchmarks against representative cleanup prompts:

Model ID	Profile	TTFT p50
openai.gpt-oss-120b-1:0	Fastest (default)	~400 ms
us.anthropic.claude-haiku-4-5-20251001-v1:0	Balanced	~880 ms

Cleanup is a low-stakes editing task; either model handles it well. GPT-OSS is the default because the latency advantage is noticeable in practice. Switch to Claude Haiku if you've already standardized on Anthropic across your tooling and want consistent style.

Custom model IDs work too — Settings has a Model picker with a "Custom…" option that lets you paste any Bedrock model ID or inference-profile ID. Just confirm it's enabled in the region's model-access page first.

Bedrock charges per token at the model-specific rate — no monthly subscription. Cleanup prompts are short (a few hundred input tokens, a few hundred output tokens), so a typical day of dictation runs to single-digit cents. Parleq's Settings → Usage tab tracks per-call token counts and rolls them into a running cost estimate using AWS's published rates.

See the current rates at aws.amazon.com/bedrock/pricing. There's no charge for unused capacity — Bedrock is fully on-demand.

Bedrock-served models do not use prompts or completions for training. Traffic stays within your AWS account boundary; the same VPC / IAM / CloudTrail controls you've already configured for AWS apply. If you're already using AWS for other compliance-sensitive workloads, Parleq fits inside that approval — no separate vendor review.

Audio never reaches AWS. Only the text transcript output by Parleq's on-device speech model is sent. Logs include length-only diagnostics; transcript text is never written to ~/.parleq/app.log.