{"record":{"id":"0765f725e0fbf7a5","repo":"openai/openai-python","slug":"could-not-find-credentials-for-bedrock-pass-a-bea-0765f7","errorCode":null,"errorMessage":"Could not find credentials for Bedrock. Pass a bearer credential or AWS credentials to `bedrock(...)`, set `AWS_BEARER_TOKEN_BEDROCK`, or configure the default AWS credential chain.","messagePattern":"Could not find credentials for Bedrock\\. Pass a bearer credential or AWS credentials to `bedrock\\(\\.\\.\\.\\)`, set `AWS_BEARER_TOKEN_BEDROCK`, or configure the default AWS credential chain\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":325,"sourceCode":"                None,\n            )\n\n        auth = BedrockAwsAuth.resolve(\n            region=None,\n            profile=self.profile,\n            access_key_id=self.access_key_id,\n            secret_access_key=self.secret_access_key,\n            session_token=self.session_token,\n            credentials_provider=self.credential_provider,\n            service=\"bedrock\" if self.endpoint == \"runtime\" else \"bedrock-mantle\",\n        )\n        return auth.config, auth\n\n    def configure(self) -> _ProviderRuntime:\n        def environment_token() -> str:\n            token = os.environ.get(\"AWS_BEARER_TOKEN_BEDROCK\")\n            if not token:\n                raise OpenAIError(\n                    \"Could not find credentials for Bedrock. Pass a bearer credential or AWS credentials to \"\n                    \"`bedrock(...)`, set `AWS_BEARER_TOKEN_BEDROCK`, or configure the default AWS credential chain.\"\n                )\n            return token\n\n        auth: _BedrockBearerAuth | _BedrockSigV4Auth | None = None\n        bearer_provider: BedrockTokenProvider | None = None\n        if self.api_key is not None:\n            bearer_provider = lambda: self.api_key or \"\"\n            region = self.configured_region\n        elif self.token_provider is not None:\n            bearer_provider = self.token_provider\n            region = self.configured_region\n        elif self.use_environment_bearer:\n            bearer_provider = environment_token\n            region = self.configured_region\n        else:\n            aws_config, aws_auth = self._resolve_aws_auth()","sourceCodeStart":307,"sourceCodeEnd":343,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L307-L343","documentation":"When no explicit bearer or AWS credentials are supplied, configure() falls back to AWS_BEARER_TOKEN_BEDROCK; if that env var is unset or empty, the environment_token closure raises this OpenAIError at client construction. The message lists every accepted way to provide Bedrock credentials.","triggerScenarios":"Instantiating OpenAI(provider=bedrock(...)) with no bearer/credentials arguments while AWS_BEARER_TOKEN_BEDROCK, and no default AWS credential chain usable for SigV4, are available; the token provider is then invoked and raises.","commonSituations":"Local dev without AWS env configured; CI containers lacking ~/.aws and env vars; typos in the env var name; forgotten aws_credentials parameter.","solutions":["Pass a bearer token or AWS credentials to bedrock(...).","Export AWS_BEARER_TOKEN_BEDROCK (or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/region) in the environment where the process runs.","Verify with `aws sts get-caller-identity` that the default chain resolves in that shell/container."],"exampleFix":"# before\nclient = OpenAI(provider=bedrock(region=\"us-east-1\"))\n\n# after\nclient = OpenAI(provider=bedrock(region=\"us-east-1\", aws_credentials=creds))\n# or: export AWS_BEARER_TOKEN_BEDROCK=...","handlingStrategy":"validation","validationCode":"import os\nhas_bearer = bool(os.environ.get(\"AWS_BEARER_TOKEN_BEDROCK\", \"\").strip())\nhas_chain = bool(os.environ.get(\"AWS_ACCESS_KEY_ID\") and os.environ.get(\"AWS_SECRET_ACCESS_KEY\"))\nassert has_bearer or has_chain or explicit_credentials, \"no Bedrock credentials configured\"","typeGuard":"def has_bedrock_credentials(bearer_arg=None, creds_arg=None) -> bool:\n    import os\n    return any([bearer_arg, creds_arg, os.environ.get(\"AWS_BEARER_TOKEN_BEDROCK\", \"\").strip(), os.environ.get(\"AWS_ACCESS_KEY_ID\")])","tryCatchPattern":"try:\n    client = OpenAI(provider=bedrock(region=region))\nexcept OpenAIError as e:\n    if \"Could not find credentials\" in str(e):\n        raise RuntimeError(\"configure AWS_BEARER_TOKEN_BEDROCK or pass credentials\") from e\n    raise","preventionTips":["Set AWS_BEARER_TOKEN_BEDROCK in deployment environments or pass credentials explicitly.","Add a startup credential check before serving traffic.","Verify with `aws sts get-caller-identity` in the same shell/container."],"tags":["bedrock","aws","credentials","env-var"],"backgroundTag":"missing-aws-credentials","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}