{"record":{"id":"0e998ceb71bb0596","repo":"openai/openai-python","slug":"invalid-workload-identity-configuration-expecte","errorCode":null,"errorMessage":"Invalid `workload_identity` configuration: expected an X.509 or subject-token identity","messagePattern":"Invalid `workload_identity` configuration: expected an X\\.509 or subject-token identity","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/_client.py","lineNumber":297,"sourceCode":"        self.project = project\n\n        if webhook_secret is None:\n            webhook_secret = os.environ.get(\"OPENAI_WEBHOOK_SECRET\")\n        self.webhook_secret = webhook_secret\n\n        self.websocket_base_url = websocket_base_url\n\n        if is_x509_workload_identity(workload_identity):\n            x509_identity = workload_identity\n            subject_token_identity = None\n        elif workload_identity is None:\n            x509_identity = None\n            subject_token_identity = None\n        elif \"provider\" in workload_identity:\n            x509_identity = None\n            subject_token_identity = workload_identity\n        else:\n            raise OpenAIError(\"Invalid `workload_identity` configuration: expected an X.509 or subject-token identity\")\n        if provider_runtime is not None:\n            base_url = provider_runtime.base_url\n        elif base_url is None:\n            base_url = os.environ.get(\"OPENAI_BASE_URL\")\n        self._base_url_was_default = provider_runtime is None and base_url is None\n        self._data_residency = data_residency\n        if base_url is None:\n            base_url = MTLS_API_BASE_URL if x509_identity is not None else \"https://api.openai.com/v1\"\n        if x509_identity is not None:\n            validate_x509_api_url(base_url)\n\n        self._ambient_authorizations = frozenset()\n        custom_headers_env = os.environ.get(\"OPENAI_CUSTOM_HEADERS\") if provider_runtime is None else None\n        if custom_headers_env is not None:\n            parsed: dict[str, str] = {}\n            for line in custom_headers_env.split(\"\\n\"):\n                colon = line.find(\":\")\n                if colon >= 0:","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/_client.py#L279-L315","documentation":"The `workload_identity` argument must be a dict containing either an X.509 identity (keys like `certificate_source_path`/private key material) or a `\"provider\"` key for a subject-token identity. Any other shape — missing keys, wrong type, partial dicts — raises this OpenAIError at construction.","triggerScenarios":"`workload_identity={'foo': 'bar'}`; passing a cert path without the expected key names; passing a string or an object instead of a supported dict shape; typos in key names like `certificate_source` vs `certificate_source_path`.","commonSituations":"First-time X.509 setup from docs examples; config files where nested keys got flattened or renamed; version upgrades that changed accepted shapes.","solutions":["Use a documented X.509 shape: `workload_identity={'certificate_source_path': ..., 'private_key': ...}` per current docs","For subject tokens: `workload_identity={'provider': ...}`","Validate keys before constructing; log the dict's keys (not secrets) on failure"],"exampleFix":"# before\nclient = OpenAI(workload_identity={'cert': '/tmp/c.pem'})\n\n# after\nclient = OpenAI(workload_identity={'certificate_source_path': '/tmp/c.pem', 'private_key': key})","handlingStrategy":"validation","validationCode":"def is_valid_workload_identity(w: object) -> bool:\n    if not isinstance(w, dict):\n        return False\n    return 'provider' in w or ('certificate_source_path' in w or 'private_key' in w)\n\nassert is_valid_workload_identity(identity), 'workload_identity must be an X.509 or subject-token dict'","typeGuard":"def is_workload_identity_dict(w: object) -> bool:\n    return isinstance(w, dict) and (('provider' in w) ^ bool({'certificate_source_path', 'private_key'} & set(w)))","tryCatchPattern":"try:\n    client = OpenAI(workload_identity=identity)\nexcept OpenAIError as e:\n    if 'Invalid `workload_identity`' in str(e):\n        raise ValueError('Check workload_identity keys against current docs') from e\n    raise","preventionTips":["Copy identity dict shapes verbatim from current SDK docs — keys are exact","Log identity keys (never private values) when debugging construction failures"],"tags":["auth","workload-identity","x509","configuration","validation"],"backgroundTag":"invalid-auth-configuration","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}