{"record":{"id":"1bb41a6708b86684","repo":"openai/openai-python","slug":"bedrock-authentication-is-ambiguous-configure-exa","errorCode":null,"errorMessage":"Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, static AWS credentials, profile, or credential provider.","messagePattern":"Bedrock authentication is ambiguous\\. Configure exactly one explicit mode: bearer credential, static AWS credentials, profile, or credential provider\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/lib/bedrock.py","lineNumber":145,"sourceCode":"def _legacy_provider(\n    *,\n    api_key: str | None,\n    token_provider: BedrockTokenProvider | AsyncBedrockTokenProvider | None,\n    aws_region: str | None,\n    aws_profile: str | None,\n    aws_access_key_id: str | None,\n    aws_secret_access_key: str | None,\n    aws_session_token: str | None,\n    aws_credentials_provider: AwsCredentialsProvider | None,\n    base_url: str | httpx2.URL | None,\n    region_was_explicit: bool | None = None,\n) -> tuple[_Provider, _LegacyBedrockState, str]:\n    if callable(cast(object, api_key)):\n        raise OpenAIError(\"Pass refreshable Bedrock credentials via `bedrock_token_provider`, not `api_key`.\")\n    if api_key == \"\":\n        raise OpenAIError(\"The `api_key` argument must not be empty.\")\n    if api_key is not None and token_provider is not None:\n        raise OpenAIError(\n            \"Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, \"\n            \"static AWS credentials, profile, or credential provider.\"\n        )\n\n    explicit_aws_auth = _has_explicit_aws_auth(\n        aws_profile=aws_profile,\n        aws_access_key_id=aws_access_key_id,\n        aws_secret_access_key=aws_secret_access_key,\n        aws_session_token=aws_session_token,\n        aws_credentials_provider=aws_credentials_provider,\n    )\n    if (api_key is not None or token_provider is not None) and explicit_aws_auth:\n        raise OpenAIError(\n            \"Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, \"\n            \"static AWS credentials, profile, or credential provider.\"\n        )\n\n    environment_token = os.environ.get(\"AWS_BEARER_TOKEN_BEDROCK\")","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/lib/bedrock.py#L127-L163","documentation":"Bedrock authentication supports exactly one explicit mode. This variant fires when both a bearer credential (`api_key`) and a token provider (`bedrock_token_provider`) are supplied at construction time.","triggerScenarios":"`BedrockOpenAI(api_key='token', bedrock_token_provider=fn)` — both a non-None `api_key` and a non-None `token_provider` in the same constructor call.","commonSituations":"Migrating incrementally to `bedrock_token_provider` while leaving the old `api_key` argument in place; defaults from a shared config dict that sets both fields.","solutions":["Remove `api_key` and keep only `bedrock_token_provider`","If the token is static, remove `bedrock_token_provider` and keep `api_key`"],"exampleFix":"# before\nclient = BedrockOpenAI(api_key='static-token', bedrock_token_provider=refresh_fn)\n# after\nclient = BedrockOpenAI(bedrock_token_provider=refresh_fn)","handlingStrategy":"validation","validationCode":"assert not (api_key is not None and token_provider is not None), 'choose one auth mode'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure exactly one of api_key / bedrock_token_provider / aws_* credentials","Keep auth kwargs in one place rather than merging dicts"],"tags":["bedrock","authentication","ambiguous-config","aws"],"backgroundTag":"conflicting-auth-configuration","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}