{"record":{"id":"22fd837b5eaaefe1","repo":"openai/openai-python","slug":"pass-refreshable-bedrock-credentials-via-bedrock","errorCode":null,"errorMessage":"Pass refreshable Bedrock credentials via `bedrock_token_provider`, not `api_key`.","messagePattern":"Pass refreshable Bedrock credentials via `bedrock_token_provider`, not `api_key`\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/lib/bedrock.py","lineNumber":141,"sourceCode":"        )\n    return token\n\n\ndef _legacy_provider(\n    *,\n    api_key: str | None,\n    token_provider: BedrockTokenProvider | AsyncBedrockTokenProvider | None,\n    aws_region: str | None,\n    aws_profile: str | None,\n    aws_access_key_id: str | None,\n    aws_secret_access_key: str | None,\n    aws_session_token: str | None,\n    aws_credentials_provider: AwsCredentialsProvider | None,\n    base_url: str | httpx2.URL | None,\n    region_was_explicit: bool | None = None,\n) -> tuple[_Provider, _LegacyBedrockState, str]:\n    if callable(cast(object, api_key)):\n        raise OpenAIError(\"Pass refreshable Bedrock credentials via `bedrock_token_provider`, not `api_key`.\")\n    if api_key == \"\":\n        raise OpenAIError(\"The `api_key` argument must not be empty.\")\n    if api_key is not None and token_provider is not None:\n        raise OpenAIError(\n            \"Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, \"\n            \"static AWS credentials, profile, or credential provider.\"\n        )\n\n    explicit_aws_auth = _has_explicit_aws_auth(\n        aws_profile=aws_profile,\n        aws_access_key_id=aws_access_key_id,\n        aws_secret_access_key=aws_secret_access_key,\n        aws_session_token=aws_session_token,\n        aws_credentials_provider=aws_credentials_provider,\n    )\n    if (api_key is not None or token_provider is not None) and explicit_aws_auth:\n        raise OpenAIError(\n            \"Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, \"","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/lib/bedrock.py#L123-L159","documentation":"The Bedrock client's `api_key` parameter only accepts a static string bearer token. Passing a callable (the pattern used for refreshable credentials on the regular OpenAI client) is rejected because Bedrock credential refresh must go through the dedicated `bedrock_token_provider` argument.","triggerScenarios":"Constructing `BedrockOpenAI(api_key=lambda: os.environ['AWS_BEARER_TOKEN_BEDROCK'])` or calling `with_options(api_key=callable)` — any callable value for `api_key` on a Bedrock client (sync or async, __init__ or copy).","commonSituations":"Porting code from `OpenAI(api_key=callable)` to `BedrockOpenAI`; assuming the refreshable-api_key pattern is uniform across clients; wrapping expiring AWS bearer tokens in a closure out of habit.","solutions":["Move the callable to the `bedrock_token_provider=` argument of `BedrockOpenAI`","If you truly have a static token, pass the string directly to `api_key`","For AWS SigV4-style auth, pass `aws_access_key_id`/`aws_secret_access_key`/`aws_session_token` or `aws_profile` instead"],"exampleFix":"// before\nclient = BedrockOpenAI(api_key=lambda: fetch_bearer_token())\n// after\nclient = BedrockOpenAI(bedrock_token_provider=fetch_bearer_token)","handlingStrategy":"validation","validationCode":"def is_static_key(api_key):\n    return not callable(api_key)\n\nassert not callable(api_key), 'use bedrock_token_provider for callables'","typeGuard":"def is_bedrock_static_key(v) -> TypeGuard[str | None]:\n    return v is None or isinstance(v, str)","tryCatchPattern":null,"preventionTips":["Never pass callables as api_key to Bedrock clients","Use bedrock_token_provider for any refreshable Bedrock credential"],"tags":["bedrock","authentication","api-key","aws","config"],"backgroundTag":"invalid-credential-configuration","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}