{"record":{"id":"5d5f052bf2091336","repo":"openai/openai-python","slug":"the-api-key-and-workload-identity-arguments-ar","errorCode":null,"errorMessage":"The `api_key` and `workload_identity` arguments are mutually exclusive","messagePattern":"The `api_key` and `workload_identity` arguments are mutually exclusive","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/_client.py","lineNumber":232,"sourceCode":"                    (\"workload_identity\", workload_identity),\n                    (\"base_url\", base_url),\n                )\n                if value is not None\n            ]\n            if conflicts:\n                formatted = \", \".join(f\"`{name}`\" for name in conflicts)\n                raise OpenAIError(\n                    f\"`provider` cannot be combined with top-level {formatted}. \"\n                    f\"Move provider authentication and routing options into `{provider_name}(...)`.\"\n                )\n\n            provider_runtime = _configure_provider(provider)\n\n        self._provider = provider\n        self._provider_runtime = provider_runtime\n\n        if api_key is not None and api_key != WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER and workload_identity is not None:\n            raise OpenAIError(\"The `api_key` and `workload_identity` arguments are mutually exclusive\")\n\n        if is_x509_workload_identity(workload_identity):\n            workload_identity = workload_identity.copy()\n        self.workload_identity = workload_identity if provider_runtime is None else None\n\n        if provider_runtime is not None:\n            self.api_key = \"\"\n            self._api_key_provider = None\n            self._workload_identity_auth = None\n        elif workload_identity is not None:\n            self.api_key = WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER\n            self._api_key_provider = None\n            self._workload_identity_auth = None\n        else:\n            if api_key is None:\n                api_key = os.environ.get(\"OPENAI_API_KEY\")\n            if callable(api_key):\n                self.api_key = \"\"","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/_client.py#L214-L250","documentation":"`OpenAI.__init__` forbids passing a real `api_key` together with `workload_identity`: X.509/subject-token identities manage their own credentials, so an explicit API key alongside them is a configuration error. The placeholder value used internally for workload identity is exempt.","triggerScenarios":"`OpenAI(api_key='sk-...', workload_identity={...})`; leftover explicit api_key when enabling workload identity; config systems that inject both.","commonSituations":"Migrating from API-key auth to workload identity (e.g. service mesh/X.509) while env `OPENAI_API_KEY` is also passed explicitly; shared config templates supplying an api_key unconditionally.","solutions":["Remove `api_key` (rely on the workload identity for credentials)","Or remove `workload_identity` if you intend key-based auth","Unset `OPENAI_API_KEY` if it's being injected by a config layer you don't control"],"exampleFix":"# before\nclient = OpenAI(api_key=os.environ['OPENAI_API_KEY'], workload_identity=identity)\n\n# after\nclient = OpenAI(workload_identity=identity)","handlingStrategy":"validation","validationCode":"if api_key and workload_identity is not None:\n    raise ValueError('configure either api_key or workload_identity, not both')","typeGuard":null,"tryCatchPattern":"try:\n    client = OpenAI(api_key=api_key, workload_identity=identity)\nexcept OpenAIError as e:\n    if 'mutually exclusive' in str(e):\n        client = OpenAI(workload_identity=identity)\n    else:\n        raise","preventionTips":["Single source of truth for auth config; don't mix env-injected keys with workload identity","Conditionally read OPENAI_API_KEY only when no workload identity is configured"],"tags":["auth","workload-identity","api-key","configuration","conflict"],"backgroundTag":"conflicting-auth-configuration","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}