{"record":{"id":"3b86ba8474329093","repo":"openai/openai-python","slug":"the-api-key-argument-must-not-be-empty","errorCode":null,"errorMessage":"The `api_key` argument must not be empty.","messagePattern":"The `api_key` argument must not be empty\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/lib/bedrock.py","lineNumber":143,"sourceCode":"\n\ndef _legacy_provider(\n    *,\n    api_key: str | None,\n    token_provider: BedrockTokenProvider | AsyncBedrockTokenProvider | None,\n    aws_region: str | None,\n    aws_profile: str | None,\n    aws_access_key_id: str | None,\n    aws_secret_access_key: str | None,\n    aws_session_token: str | None,\n    aws_credentials_provider: AwsCredentialsProvider | None,\n    base_url: str | httpx2.URL | None,\n    region_was_explicit: bool | None = None,\n) -> tuple[_Provider, _LegacyBedrockState, str]:\n    if callable(cast(object, api_key)):\n        raise OpenAIError(\"Pass refreshable Bedrock credentials via `bedrock_token_provider`, not `api_key`.\")\n    if api_key == \"\":\n        raise OpenAIError(\"The `api_key` argument must not be empty.\")\n    if api_key is not None and token_provider is not None:\n        raise OpenAIError(\n            \"Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, \"\n            \"static AWS credentials, profile, or credential provider.\"\n        )\n\n    explicit_aws_auth = _has_explicit_aws_auth(\n        aws_profile=aws_profile,\n        aws_access_key_id=aws_access_key_id,\n        aws_secret_access_key=aws_secret_access_key,\n        aws_session_token=aws_session_token,\n        aws_credentials_provider=aws_credentials_provider,\n    )\n    if (api_key is not None or token_provider is not None) and explicit_aws_auth:\n        raise OpenAIError(\n            \"Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, \"\n            \"static AWS credentials, profile, or credential provider.\"\n        )","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/lib/bedrock.py#L125-L161","documentation":"The `api_key` argument was set to the empty string. An explicit empty bearer token is meaningless, so the Bedrock client rejects it rather than sending no/empty Authorization headers.","triggerScenarios":"`BedrockOpenAI(api_key='')`, typically from `api_key=os.environ.get('AWS_BEARER_TOKEN_BEDROCK', '')` or a config field defaulting to `\"\"`.","commonSituations":"Environment variable unset but `.get(..., '')` used instead of `.get(...)`; YAML/TOML config with an empty key field; copying templates that pre-fill `api_key: \"\"`.","solutions":["Use `os.environ.get('AWS_BEARER_TOKEN_BEDROCK')` (no default) so the value is None when unset","Pass `None` instead of `\"\"` to let the client fall back to environment/profile auth","Set the actual bearer token value"],"exampleFix":"# before\nclient = BedrockOpenAI(api_key=os.environ.get('AWS_BEARER_TOKEN_BEDROCK', ''))\n# after\nclient = BedrockOpenAI(api_key=os.environ.get('AWS_BEARER_TOKEN_BEDROCK'))","handlingStrategy":"validation","validationCode":"api_key = os.environ.get('AWS_BEARER_TOKEN_BEDROCK')\nassert api_key != '', 'empty bearer token'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use os.environ.get(var) without a '' default","Assert config-derived keys are non-empty before constructing clients"],"tags":["bedrock","authentication","api-key","validation"],"backgroundTag":"empty-credential-value","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}