AWS Bedrock GPT-5.6 Responses API Setup Guide

Quick answer

GPT-5.6 on Amazon Bedrock uses the OpenAI SDK and Responses API, but it does not use the direct OpenAI base URL or model slugs. Configure all three provider-specific values together:

from openai import OpenAI
from aws_bedrock_token_generator import provide_token

REGION = "us-east-2"

client = OpenAI(
    base_url=f"https://bedrock-mantle.{REGION}.api.aws/openai/v1",
    api_key=provide_token(region=REGION),
)

response = client.responses.create(
    model="openai.gpt-5.6-terra",
    instructions="Answer concisely and state uncertainty.",
    input="Explain the difference between a cache write and cache read.",
    max_output_tokens=500,
    store=False,
)

print(response.output_text)

Install the packages used by the AWS example:

pip install openai aws-bedrock-token-generator

For model selection, see the Sol, Terra, and Luna comparison.

Endpoint and model IDs

Setting	Bedrock value
Base URL	https://bedrock-mantle.{region}.api.aws/openai/v1
Responses resource	/responses through the SDK
Sol	openai.gpt-5.6-sol
Terra	openai.gpt-5.6-terra
Luna	openai.gpt-5.6-luna

The /openai/v1/responses path is specific to these OpenAI models on bedrock-mantle. Do not route it through the usual bedrock-runtime endpoint, Converse, or InvokeModel without separate documentation proving support.

The current Region choices are:

• Sol: us-east-1, us-east-2;
• Terra and Luna: us-east-1, us-east-2, us-west-2.

Read the context and Regions guide before pinning infrastructure.

Authentication choices

AWS documents Bedrock API keys and AWS credentials. Its GPT-5.6 setup post recommends short-term bearer tokens generated from the standard AWS credential chain. That lets an IAM role, environment configuration, or AWS CLI profile supply the underlying identity without a long-lived secret in application code.

For production:

1. run the workload under a dedicated role;
2. grant only the Bedrock access and Regions it needs;
3. keep credentials out of source files, images, logs, and client-side bundles;
4. verify how a token is refreshed during long streams, queues, or agent runs;
5. log identity and request metadata without logging tokens or sensitive prompts;
6. test revoked, expired, and insufficient permissions.

Long-term Bedrock API keys can simplify a limited test, but they increase rotation and leakage risk. Treat the credential choice as a deployment decision rather than copying a console quickstart into production.

A configuration boundary that prevents provider mix-ups

Keep provider, base URL, model ID, Region, and authentication in one typed configuration object. Reject combinations such as a Bedrock model ID sent to api.openai.com, a direct OpenAI slug sent to bedrock-mantle, or Sol configured in a Region where it is not documented.

provider = amazon-bedrock
region = us-east-2
base_url = https://bedrock-mantle.us-east-2.api.aws/openai/v1
model = openai.gpt-5.6-terra
auth = aws-short-term-bearer

This matters when an application supports both Bedrock and the direct OpenAI API. Similar SDK calls do not make the two deployments interchangeable.

Verify the first request

After the first successful response, record and validate:

• the returned model identifier;
• the AWS Region and deployment configuration;
• request ID and HTTP status;
• input, cached, cache-write, reasoning, and output token fields that are present;
• streaming event handling if streaming is enabled;
• tool-call and structured-output behavior for the exact schema;
• store and retention behavior required by the application;
• timeout, retry, and duplicate-call handling.

Do not use one “hello world” response as a production approval. Run representative inputs, denied permissions, malformed tool output, long context, rate limits, and cancellation.

Common setup failures

Wrong path

The SDK base URL ends in /openai/v1; the SDK appends /responses. A base URL copied from a different Bedrock API family can return an authentication or route error that looks unrelated to the model.

Wrong model naming convention

Bedrock IDs include the openai. provider prefix. Direct OpenAI slugs do not. Keep an explicit mapping instead of string concatenation.

Region mismatch

Sol is not currently documented in us-west-2, while Terra and Luna are. Validate the model-and-Region pair at startup.

Expired credentials

A token that works during startup can expire during a long-lived worker. Exercise refresh and retry paths without replaying a state-changing tool call twice.

Frequently asked questions

What endpoint does GPT-5.6 use on Amazon Bedrock?

GPT-5.6 uses the OpenAI-compatible Responses API at https://bedrock-mantle.{region}.api.aws/openai/v1, with requests sent to the responses resource by the OpenAI SDK.

What are the Bedrock model IDs for GPT-5.6?

The IDs are openai.gpt-5.6-sol, openai.gpt-5.6-terra, and openai.gpt-5.6-luna. They are different from the direct OpenAI API model slugs.

How should a production app authenticate to Bedrock GPT-5.6?

AWS recommends short-term bearer tokens generated from the standard AWS credential chain. Keep the workload on a narrow IAM role, avoid source-controlled secrets, and test token refresh before long-running or streaming work.

Official sources

• AWS: Introducing explicit prompt caching for OpenAI GPT-5.6 models on Amazon Bedrock
• AWS: Get started with GPT-5.6 Sol, Terra, and Luna
• AWS model card: GPT-5.6 Terra

Source check: August 4, 2026. Verify SDK versions, authentication, model IDs, Regions, quotas, and retention before deployment.