## Summary
Since approximately Feb 2, 2026 evening (KST), all REST API queries using AWS v4 authentication to AWS OpenSearch are failing with 400 errors due to SigV4 signature mismatch.
Nothing was changed on our side. This appears to be caused by a Retool infrastructure update that introduced new proxy headers into the request.
## Error Message
The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method.
## Root Cause Analysis
The Canonical String in the error reveals that Retool's proxy is injecting the following headers into the outbound request, which get included in the AWS SigV4 signature calculation:
- baggage: Contains Sentry tracing data (sentry-release=3.332.0, sentry-environment=production) - x-datadog-parent-id - x-datadog-sampling-priority - x-datadog-tags - x-datadog-trace-id - ot-baggage-requestid: undefined
These headers are Retool's own observability/monitoring headers (Sentry, Datadog), NOT user-configured headers.
## Signed Headers (from error)
Actual: baggage;content-length;content-type;host;ot-baggage-requestid;x-amz-date;x-datadog-parent-id;x-datadog-sampling-priority;x-datadog-tags;x-datadog-trace-id
Expected: content-length;content-type;host;x-amz-date
## Environment
- Retool version: 3.334.0 (Cloud) - Resource type: REST API with AWS v4 authentication - AWS Service: OpenSearch (ap-northeast-2) - "Exclude default headers": Checked but does NOT remove the tracing headers
## Impact
All OpenSearch queries fail with 400 errors. Dashboard is completely non-functional.
## Steps to Reproduce
1. Create a REST API resource with AWS v4 authentication 2. Point it to any AWS service (e.g., OpenSearch) 3. Run any query - 400 error with SigV4 signature mismatch 4. Inspect the canonical string - observe baggage, x-datadog-* headers
## Workaround Attempted
Checked "Exclude default headers" - Did NOT fix (tracing headers injected at proxy level)
## Expected Behavior
Retool's internal observability headers should NOT be included in AWS SigV4 canonical string. This is a P0 regression for anyone using AWS v4 authenticated resources.
Breakage report also filed via in-app form.
