{"record":{"id":"2fcd18783613d789","repo":"openai/openai-python","slug":"expected-bedrock-token-provider-argument-to-retu","errorCode":null,"errorMessage":"Expected `bedrock_token_provider` argument to return a non-empty string.","messagePattern":"Expected `bedrock_token_provider` argument to return a non-empty string\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"src/openai/lib/bedrock.py","lineNumber":525,"sourceCode":"        return (\"aws\", None)\n\n    def _uses_aws_auth(self) -> bool:\n        return (\n            self._bedrock_state.explicit_api_key is None\n            and not self.api_key\n            and self._bedrock_token_provider is None\n            and not self._bedrock_state.uses_environment_bearer\n        )\n\n    @override\n    def _refresh_api_key(self) -> str:\n        if self._bedrock_state.uses_environment_bearer:\n            captured = self._bedrock_state.environment_bearer_token or \"\"\n            return self.api_key if self.api_key and self.api_key != captured else captured\n        if self._bedrock_token_provider is not None:\n            token = cast(object, self._bedrock_token_provider())\n            if not isinstance(token, str) or not token:\n                raise ValueError(\"Expected `bedrock_token_provider` argument to return a non-empty string.\")\n            return token\n        return self.api_key\n\n    @override\n    def _prepare_options(self, options: FinalRequestOptions) -> FinalRequestOptions:\n        _refresh_legacy_provider_runtime(self)\n        return super()._prepare_options(options)\n\n    @override\n    def copy(\n        self,\n        *,\n        api_key: str | BedrockTokenProvider | None = None,\n        admin_api_key: str | None = None,\n        workload_identity: WorkloadIdentity | X509WorkloadIdentity | None = None,\n        provider: _Provider | None | NotGiven = NOT_GIVEN,\n        bedrock_token_provider: BedrockTokenProvider | None = None,\n        aws_region: str | None = None,","sourceCodeStart":507,"sourceCodeEnd":543,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/lib/bedrock.py#L507-L543","documentation":"The sync client's `_refresh_api_key` calls the user-supplied `bedrock_token_provider` and requires it to return a non-empty string. A provider returning `None`, an empty string, or a non-string value fails this check before the request is sent.","triggerScenarios":"`BedrockOpenAI(bedrock_token_provider=lambda: None)` or a provider whose token fetch fails and returns `''`/None; raised on the first request (or token refresh) that invokes the provider.","commonSituations":"Token endpoint outage causing the fetch helper to return None instead of raising; providers written to return empty on failure; caching layers returning a missing key's default `\"\"`.","solutions":["Make the provider raise a clear exception on failure instead of returning None/empty","Fix the provider to always return the token string, e.g. `os.environ['AWS_BEARER_TOKEN_BEDROCK']` (raises KeyError if unset)","Add logging/retries around the token fetch inside the provider"],"exampleFix":"# before\nclient = BedrockOpenAI(bedrock_token_provider=lambda: os.environ.get('AWS_BEARER_TOKEN_BEDROCK'))\n# after\nclient = BedrockOpenAI(bedrock_token_provider=lambda: os.environ['AWS_BEARER_TOKEN_BEDROCK'])","handlingStrategy":"validation","validationCode":"def provider():\n    token = fetch_token()\n    if not isinstance(token, str) or not token:\n        raise RuntimeError('token fetch failed')\n    return token","typeGuard":null,"tryCatchPattern":"try:\n    resp = client.chat.completions.create(...)\nexcept ValueError as e:\n    if 'non-empty string' in str(e):\n        refresh_and_retry()","preventionTips":["Never let a token provider return None or empty string; raise instead","Log token-refresh outcomes inside the provider"],"tags":["bedrock","authentication","token-provider","sync"],"backgroundTag":"token-provider-returned-invalid-token","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}