{"record":{"id":"04d67ba2dcd6fd58","repo":"openai/openai-python","slug":"the-bedrock-bearer-credential-must-not-be-empty","errorCode":null,"errorMessage":"The Bedrock bearer credential must not be empty.","messagePattern":"The Bedrock bearer credential must not be empty\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/lib/bedrock.py","lineNumber":346,"sourceCode":"    )\n    return _LegacyRuntimeSignature(\n        mode=mode,\n        base_url=str(client.base_url),\n        region=client.aws_region,\n        credential_identity=credential_identity,\n    )\n\n\ndef _provider_for_legacy_client(\n    client: BedrockOpenAI | AsyncBedrockOpenAI,\n    configuration: _LegacyAuthConfiguration,\n) -> _Provider:\n    mode, credential = configuration\n    state = client._bedrock_state\n    bearer_region = client.aws_region if state.region_was_explicit else None\n    if mode == \"bearer\":\n        if not isinstance(credential, str) or not credential:\n            raise OpenAIError(\"The Bedrock bearer credential must not be empty.\")\n        return bedrock(\n            endpoint=_legacy_endpoint(client.base_url),\n            region=bearer_region,\n            base_url=client.base_url,\n            api_key=credential,\n        )\n    if mode == \"token_provider\":\n        return bedrock(\n            endpoint=_legacy_endpoint(client.base_url),\n            region=bearer_region,\n            base_url=client.base_url,\n            token_provider=cast(\"AsyncBedrockTokenProvider\", credential),\n        )\n\n    return bedrock(\n        endpoint=_legacy_endpoint(client.base_url),\n        region=client.aws_region,\n        base_url=client.base_url,","sourceCodeStart":328,"sourceCodeEnd":364,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/lib/bedrock.py#L328-L364","documentation":"While (re)building the internal provider for a legacy-mode Bedrock client, the stored bearer credential was missing or empty. This indicates corrupted internal state — the client was constructed in bearer mode but the credential no longer validates.","triggerScenarios":"Triggered internally by `_provider_for_legacy_client` during `_refresh_legacy_provider_runtime` (e.g. in `_prepare_options` before each request) when the client's saved bearer-mode credential is not a non-empty string — for example after state refresh logic cleared it.","commonSituations":"Custom code mutating client internals or stale state after auth reconfiguration; typically only reachable via unusual subclassing or a bug — not normal user input.","solutions":["Reconstruct the `BedrockOpenAI` client with a valid non-empty bearer token or token provider","If it reproduces with normal usage, report it as an SDK bug with a minimal reproducer"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    resp = client.chat.completions.create(...)\nexcept OpenAIError as e:\n    if 'bearer credential must not be empty' in str(e):\n        client = BedrockOpenAI(api_key=fresh_token)  # rebuild client\n    else:\n        raise","preventionTips":["Treat this as an SDK-state bug; reconstruct the client if it fires","Avoid subclassing or mutating Bedrock client internals"],"tags":["bedrock","authentication","internal-state","bearer-token"],"backgroundTag":"empty-credential-value","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}