{"record":{"id":"1bedda30940ef3f1","repo":"openai/openai-python","slug":"bedrock-provider-authentication-cannot-be-combined","errorCode":null,"errorMessage":"Bedrock provider authentication cannot be combined with a custom `Authorization` header.","messagePattern":"Bedrock provider authentication cannot be combined with a custom `Authorization` header\\.","errorType":"error_code","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":128,"sourceCode":"\n\ndef _same_origin(left: httpx2.URL, right: httpx2.URL) -> bool:\n    return (left.scheme, left.host, left.port) == (right.scheme, right.host, right.port)\n\n\ndef _body_for_signing(request: httpx2.Request) -> bytes:\n    try:\n        return request.content\n    except request_not_read_exceptions() as exc:\n        raise OpenAIError(\n            \"Bedrock SigV4 authentication requires a replayable request body. \"\n            \"Buffer the body before sending or use bearer authentication.\"\n        ) from exc\n\n\ndef _assert_provider_owns_authorization(request: httpx2.Request) -> None:\n    if \"Authorization\" in request.headers:\n        raise OpenAIError(\"Bedrock provider authentication cannot be combined with a custom `Authorization` header.\")\n\n\ndef _without_redirects(options: FinalRequestOptions) -> FinalRequestOptions:\n    if options.follow_redirects:\n        raise OpenAIError(\n            \"Bedrock SigV4 authentication does not support automatic redirects. \"\n            \"Send a new request to the redirect target so it can be signed again.\"\n        )\n    options.follow_redirects = False\n    return options\n\n\nclass _BedrockBearerAuth:\n    def __init__(self, token_provider: BedrockTokenProvider, *, base_url: httpx2.URL) -> None:\n        self._token_provider = token_provider\n        self._base_url = base_url\n\n    def _validate_request(self, request: httpx2.Request) -> None:","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L110-L146","documentation":"The Bedrock provider signs or sets the Authorization header itself (SigV4 signature or bearer token). A request that already carries a user-supplied Authorization header would have it overwritten or double-authenticated, so the provider aborts before sending.","triggerScenarios":"Passing `default_headers={\"Authorization\": \"Bearer ...\"}` or `extra_headers={\"Authorization\": ...}` to a client configured with the bedrock provider.","commonSituations":"Copying generic OpenAI examples that set Authorization manually; migrating code that authenticated with a static key before switching to bedrock().","solutions":["Remove the Authorization header from default_headers/extra_headers and let the provider inject credentials.","If you truly need your own bearer token, supply it via the provider's bearer credential configuration instead of a raw header."],"exampleFix":"// before\nclient = OpenAI(provider=bedrock(...), default_headers={\"Authorization\": f\"Bearer {tok}\"})\n\n// after\nclient = OpenAI(provider=bedrock(bearer=...))","handlingStrategy":"validation","validationCode":"headers.pop(\"Authorization\", None)  # before constructing the bedrock client\nassert \"Authorization\" not in (default_headers or {})","typeGuard":"def has_no_auth_header(headers: dict) -> bool:\n    return \"Authorization\" not in {k.lower() for k in headers}","tryCatchPattern":"try:\n    client = OpenAI(provider=bedrock(...), default_headers=headers)\nexcept OpenAIError as e:\n    if \"Authorization\" in str(e):\n        headers.pop(\"Authorization\", None)\n        client = OpenAI(provider=bedrock(...), default_headers=headers)\n    else:\n        raise","preventionTips":["Never set Authorization manually with provider-based auth; supply credentials via bedrock(...).","Audit shared default_headers dicts reused across providers.","Keep provider-specific auth in the provider config, not in headers."],"tags":["bedrock","aws","authorization","headers"],"backgroundTag":"duplicate-authorization-header","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}