Kiro

Kiro (kiro, alias kr) is Amazon's coding assistant backend. Claude-format requests use a direct translation route to preserve thinking blocks and tool IDs.

The provider page shows a risk notice: this is a subscription session that was not licensed for router use. Use an account you can afford to lose.

Pick a sign-in method

Open Providers, then Kiro, then Connect. The modal offers seven methods.

Builder ID and IAM Identity Center

These use a device code. DurinDoor registers an OIDC client at oidc.<region>.amazonaws.com, shows a verification URL and code, and polls until you approve it. After login it fetches your profileArn. If AWS returns none, the connection is not saved, because every chat call would fail with 403 without it.

Google and GitHub

Kiro's login only redirects to a kiro:// address, which a browser cannot open. After you sign in, the browser shows or fails on a kiro://kiro.kiroAgent/authenticate-success?code=...&state=... URL. Copy that whole URL from the address bar and paste it into the modal.

API key

DurinDoor checks the key against Kiro's profile list before saving. It has no refresh token. Requests send the key as Bearer with tokentype: API_KEY.

Import from the Kiro IDE

If the Kiro IDE is signed in on the same machine as DurinDoor, the Import Token method can pre-fill the refresh token from the AWS SSO cache. DurinDoor looks in ~/.aws/sso/cache for kiro-auth-token.json first, then any other JSON file there, and reads client credentials from the matching <clientIdHash>.json. If that folder is missing you get AWS SSO cache not found. Please login to Kiro IDE first.

The profile ARN is read from %APPDATA%/Kiro/User/globalStorage/kiro.kiroagent/profile.json on Windows or ~/.config/Kiro/... elsewhere. There is no macOS ~/Library lookup, so an import on a Mac may arrive without a profile ARN. If chat then fails with profileArn is required, connect with Builder ID or Identity Center instead; those flows fetch the ARN themselves.

A pasted token that matches the SSO cache is treated as an external identity provider login. One with a client id and secret becomes an IAM Identity Center connection. Anything else is saved as a plain imported token.

CLIProxyAPI JSON

Use this for Microsoft external identity accounts that CLIProxyAPI already signed in. Paste its JSON; DurinDoor accepts the object directly or under cliProxyAuth, auth, or json.

Refresh

Before a request the executor re-reads the SSO cache, then refreshes if needed. External identity tokens refresh at their own token endpoint. Connections with a client id and secret refresh through AWS OIDC, in your region for Identity Center and in us-east-1 otherwise. The rest go to Kiro's own refresh endpoint. API key connections never refresh.

Models and quota

Send kr/<model>, for example kr/claude-opus-4.8. The catalog includes thinking and agentic variants. Use the exact available IDs rather than assuming a fixed model count. GET /v1/models is the live list.

The Quota Tracker reads Kiro's usage limits, for OAuth and API key connections alike. Kiro uses the any-sufficient preflight gate: an account stays eligible while any of its pools has room.

Output limits

Translated OpenAI and Claude requests with an explicit max_tokens or max_completion_tokens return HTTP 400 because this Kiro transport cannot verify that the provider enforces the requested ceiling. Omit the ceiling or select a provider that supports it. The uncapped request's legacy 32000 default is not an enforcement guarantee. Native Kiro requests retain their existing settings.

Images

Kiro requires inline image bytes. For vision-capable models, the chat gateway resolves top-level OpenAI image_url HTTP(S) URLs and Claude URL image sources before translation, then sends native Kiro image blocks. Both streaming and non-streaming requests use this path; a URL rendered as text is not image support.

The resolver rejects private or blocked hosts, redirects, oversized responses, and unrecognized image signatures. If a remote image cannot be resolved, the request returns a client error rather than silently dropping the image. Supply an OpenAI base64 data URI (data:image/png;base64,...) or a Claude source: { type: "base64", media_type: "image/png", data: "..." } instead. Nested remote images inside Claude tool results are not resolved by this path and return HTTP 400, rather than being serialized as tool-result text. Nested base64 images remain supported.

For paired Claude tool history, inline tool-result images remain native user images even when the client omits tool declarations. Tool calls and result text are flattened in that case, retaining failure markers; unresolved remote images still return HTTP 400 before they can be lost during flattening. This applies to both completed history and the active turn.

Synchronous translation and the dashboard translator do not fetch remote images. Supply inline data there; unresolved images return HTTP 400. Same-format OpenAI passthrough preserves image URLs without this Kiro conversion.

Errors

Kiro does not retry 429 on its own; the request moves on to the next account.

MITM mode

MITM Proxy (/dashboard/mitm) can also intercept the Kiro IDE's calls to its us-east-1 runtime hosts and send them through DurinDoor. That is separate from the connection on this page. See Troubleshooting for recovery steps.

After connecting, send a short request with an ID from GET /v1/models and confirm Usage. If an imported token lacks the profile ARN, use Builder ID or Identity Center to acquire it. Token acquisition and a quota row do not prove that the selected model can answer.