{"record":{"id":"66b2a701e93e26a4","repo":"openai/openai-python","slug":"bedrockopenai-only-supports-bedrock-bearer-token-o","errorCode":null,"errorMessage":"BedrockOpenAI only supports Bedrock bearer token or AWS credential authentication.","messagePattern":"BedrockOpenAI only supports Bedrock bearer token or AWS credential authentication\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/lib/bedrock.py","lineNumber":573,"sourceCode":"        timeout: float | Timeout | None | NotGiven = NOT_GIVEN,\n        http_client: httpx2.Client | None = None,\n        max_retries: int | NotGiven = NOT_GIVEN,\n        default_headers: Mapping[str, str] | None = None,\n        set_default_headers: Mapping[str, str] | None = None,\n        default_query: Mapping[str, object] | None = None,\n        set_default_query: Mapping[str, object] | None = None,\n        _enforce_credentials: bool | None = None,\n        _extra_kwargs: Mapping[str, Any] = {},\n    ) -> Self:\n        if data_residency is not None:\n            raise OpenAIError(\"`data_residency` is only supported by OpenAI clients\")\n        base_url = None if isinstance(base_url, NotGiven) else base_url\n        if callable(api_key):\n            raise OpenAIError(\"Pass refreshable Bedrock credentials via `bedrock_token_provider`, not `api_key`.\")\n        if not isinstance(provider, NotGiven):\n            raise OpenAIError(\"Configure `provider` on `OpenAI`, not on `BedrockOpenAI.with_options()`.\")\n        if admin_api_key is not None or workload_identity is not None:\n            raise OpenAIError(\"BedrockOpenAI only supports Bedrock bearer token or AWS credential authentication.\")\n        if default_headers is not None and set_default_headers is not None:\n            raise ValueError(\"The `default_headers` and `set_default_headers` arguments are mutually exclusive\")\n        if default_query is not None and set_default_query is not None:\n            raise ValueError(\"The `default_query` and `set_default_query` arguments are mutually exclusive\")\n\n        headers = self._custom_headers\n        if default_headers is not None:\n            headers = {**headers, **default_headers}\n        elif set_default_headers is not None:\n            headers = set_default_headers\n        params = self._custom_query\n        if default_query is not None:\n            params = {**params, **default_query}\n        elif set_default_query is not None:\n            params = set_default_query\n\n        provider_kwargs, inherited_provider, inherited_state = _copy_configuration(\n            self,","sourceCodeStart":555,"sourceCodeEnd":591,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/lib/bedrock.py#L555-L591","documentation":"The sync Bedrock client's `copy()` rejects `admin_api_key` and `workload_identity`. BedrockOpenAI authenticates only via Bedrock bearer tokens or AWS credentials, so OpenAI-platform admin/workload-identity options are unsupported.","triggerScenarios":"`bedrock_client.with_options(admin_api_key='...')` or `with_options(workload_identity=...)` — either argument non-None.","commonSituations":"Shared config objects feeding both OpenAI and Bedrock clients; porting platform-admin automation code to a Bedrock deployment.","solutions":["Remove `admin_api_key`/`workload_identity` from Bedrock client calls","Use an `OpenAI` client for admin/workload-identity operations","For Bedrock, authenticate with `api_key`, `bedrock_token_provider`, or `aws_*` credentials"],"exampleFix":"# before\nadmin = bedrock_client.with_options(admin_api_key=ADMIN_KEY)\n# after\nfrom openai import OpenAI\nadmin = OpenAI(admin_api_key=ADMIN_KEY)","handlingStrategy":"validation","validationCode":"for k in ('admin_api_key','workload_identity'):\n    assert kwargs.get(k) is None, f'{k} unsupported on Bedrock clients'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use OpenAI clients for admin/workload-identity auth"],"tags":["bedrock","with-options","admin-key","unsupported-parameter"],"backgroundTag":"unsupported-parameter-for-client","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}