{"record":{"id":"6156edf40eb9d7b3","repo":"openai/openai-python","slug":"refusing-to-authenticate-a-bedrock-request-for-an","errorCode":null,"errorMessage":"Refusing to authenticate a Bedrock request for an origin other than the configured provider URL.","messagePattern":"Refusing to authenticate a Bedrock request for an origin other than the configured provider URL\\.","errorType":"error_code","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":149,"sourceCode":"def _without_redirects(options: FinalRequestOptions) -> FinalRequestOptions:\n    if options.follow_redirects:\n        raise OpenAIError(\n            \"Bedrock SigV4 authentication does not support automatic redirects. \"\n            \"Send a new request to the redirect target so it can be signed again.\"\n        )\n    options.follow_redirects = False\n    return options\n\n\nclass _BedrockBearerAuth:\n    def __init__(self, token_provider: BedrockTokenProvider, *, base_url: httpx2.URL) -> None:\n        self._token_provider = token_provider\n        self._base_url = base_url\n\n    def _validate_request(self, request: httpx2.Request) -> None:\n        _assert_provider_owns_authorization(request)\n        if not _same_origin(request.url, self._base_url):\n            raise OpenAIError(\n                \"Refusing to authenticate a Bedrock request for an origin other than the configured provider URL.\"\n            )\n\n    def _resolve_token(self) -> str:\n        try:\n            token = cast(object, self._token_provider())\n        except OpenAIError:\n            raise\n        except Exception as exc:\n            raise OpenAIError(\"Failed to resolve a bearer credential for Bedrock.\") from exc\n\n        if inspect.isawaitable(token):\n            close = getattr(token, \"close\", None)\n            if callable(close):\n                close()\n            raise OpenAIError(\"An async Bedrock token provider requires `AsyncOpenAI`.\")\n        if not isinstance(token, str) or not token.strip():\n            raise OpenAIError(\"The Bedrock bearer credential provider must return a non-empty string.\")","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L131-L167","documentation":"The bearer-auth validator checks that the request URL shares scheme+host+port with the provider's configured base_url. Signing a different origin with your Bedrock bearer token would leak the credential outside Bedrock, so it refuses. This typically happens when a relative base_url causes request URLs to resolve against httpx2's default origin.","triggerScenarios":"Configuring the Bedrock provider with a base_url lacking a host (e.g. \"/bedrock\") so request.url.origin != base_url.origin; or an interceptor rewriting the request to another host.","commonSituations":"Passing a path-only base_url (common when migrating from Azure-style `base_url=\"/deployment\"` patterns); proxies mutating the URL; trailing-slash/host typos making origins differ.","solutions":["Pass a fully-qualified base_url including scheme and host, e.g. \"https://bedrock-runtime.us-east-1.amazonaws.com\".","Ensure nothing rewrites request URLs to a different origin after the client builds them."],"exampleFix":"// before\nprovider = bedrock(region=\"us-east-1\", base_url=\"/bedrock\")\n\n// after\nprovider = bedrock(region=\"us-east-1\", base_url=\"https://bedrock-runtime.us-east-1.amazonaws.com\")","handlingStrategy":"validation","validationCode":"from httpx2 import URL\nu = URL(base_url)\nassert u.scheme and u.host, \"base_url must be absolute (scheme + host)\"","typeGuard":"def is_absolute_url(base_url: str) -> bool:\n    u = URL(base_url)\n    return bool(u.scheme and u.host)","tryCatchPattern":"try:\n    client = OpenAI(provider=bedrock(region=region, base_url=base_url))\nexcept OpenAIError as e:\n    if \"origin\" in str(e):\n        client = OpenAI(provider=bedrock(region=region))  # default URL\n    else:\n        raise","preventionTips":["Always pass fully-qualified base_urls to provider configs.","Don't reuse Azure-style path-only base_url patterns with Bedrock.","Unit-test provider construction with your real config values."],"tags":["bedrock","aws","bearer","origin","base-url"],"backgroundTag":"credential-origin-mismatch","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}