CopilotKit + AWS AgentCore#

AWS Bedrock AgentCore gives you a secure, serverless runtime for deploying AG-UI agents at scale — handling auth, session isolation, and infrastructure. CopilotKit gives those agents a production-ready frontend.

How it works#

The two connect through CopilotKit Runtime, a lightweight server-side layer that sits between your browser and AgentCore. It's the same runtime you'd use with any CopilotKit-powered agent — AgentCore just requires it to run server-side (browsers can't call AgentCore directly due to SigV4/OAuth2 authentication).

Browser → CopilotKit Runtime → AgentCore Runtime → your agent

What you get#

• Chat UI — prebuilt chat interface, or headless APIs to build your own
• Shared state — bidirectional sync between agent state and your application UI
• Generative UI — render custom components from tool calls in real time
• Human-in-the-loop — let users review, approve, or redirect agent actions
• AgentCore memory — conversation history persists across sessions via AgentCore's memory layer

Quickstart#

Troubleshooting#

HTTP 401: Missing Authentication Token#

Agent execution failed: Error: HTTP 401:
{"jsonrpc":"2.0","error":{"code":-32001,"message":"Missing Authentication Token"},"id":"null"}

Missing Authentication Token is AWS's own error, not a CopilotKit or agent error. AWS returns it when a request reaches an AgentCore or API Gateway endpoint with no credentials, or when the request path matches no deployed route. Check the following, in order:

• The runtime is actually sending a token. Set AGENTCORE_ACCESS_TOKEN in the environment of the Copilot Runtime server, not the frontend. If the variable is unset, the Authorization header interpolates to Bearer undefined, which AWS rejects exactly like a missing header.
• The token has not expired. Cognito access tokens are short-lived. Mint a fresh one and retry before you debug anything else.
• AGENTCORE_ENDPOINT_URL is the full invocation URL, ending in /invocations, with the agent ARN URL-encoded: https://bedrock-agentcore.{region}.amazonaws.com/runtimes/{encoded-arn}/invocations. A URL that stops short of /invocations matches no route, and AWS reports that as Missing Authentication Token rather than as a 404.
• The browser is not calling AgentCore directly. AgentCore requires SigV4 or OAuth2 signing, which a browser cannot perform. Point the frontend at your Copilot Runtime endpoint and let the runtime make the AgentCore call server-side.

What's next?#

• Generative UI — render application components from agent tool calls.
• Shared State — synchronize structured state between the agent and application.
• Authentication — validate the frontend session at Copilot Runtime before forwarding identity to AgentCore.