{"record":{"id":"7b508bd7462c54bd","repo":"openai/openai-python","slug":"bedrock-sigv4-authentication-does-not-support-auto","errorCode":null,"errorMessage":"Bedrock SigV4 authentication does not support automatic redirects. Send a new request to the redirect target so it can be signed again.","messagePattern":"Bedrock SigV4 authentication does not support automatic redirects\\. Send a new request to the redirect target so it can be signed again\\.","errorType":"error_code","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":133,"sourceCode":"\ndef _body_for_signing(request: httpx2.Request) -> bytes:\n    try:\n        return request.content\n    except request_not_read_exceptions() as exc:\n        raise OpenAIError(\n            \"Bedrock SigV4 authentication requires a replayable request body. \"\n            \"Buffer the body before sending or use bearer authentication.\"\n        ) from exc\n\n\ndef _assert_provider_owns_authorization(request: httpx2.Request) -> None:\n    if \"Authorization\" in request.headers:\n        raise OpenAIError(\"Bedrock provider authentication cannot be combined with a custom `Authorization` header.\")\n\n\ndef _without_redirects(options: FinalRequestOptions) -> FinalRequestOptions:\n    if options.follow_redirects:\n        raise OpenAIError(\n            \"Bedrock SigV4 authentication does not support automatic redirects. \"\n            \"Send a new request to the redirect target so it can be signed again.\"\n        )\n    options.follow_redirects = False\n    return options\n\n\nclass _BedrockBearerAuth:\n    def __init__(self, token_provider: BedrockTokenProvider, *, base_url: httpx2.URL) -> None:\n        self._token_provider = token_provider\n        self._base_url = base_url\n\n    def _validate_request(self, request: httpx2.Request) -> None:\n        _assert_provider_owns_authorization(request)\n        if not _same_origin(request.url, self._base_url):\n            raise OpenAIError(\n                \"Refusing to authenticate a Bedrock request for an origin other than the configured provider URL.\"\n            )","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L115-L151","documentation":"SigV4 signatures cover the method, path, headers and body for one specific URL; blindly following a redirect would resend the signed Authorization to a different origin unsigned/invalid. The provider therefore disables automatic redirects and raises if follow_redirects was requested so the caller can re-sign each hop explicitly.","triggerScenarios":"Creating the provider with follow_redirects=True (FinalRequestOptions) — e.g. client options that enable redirect following — for a Bedrock SigV4-authenticated setup.","commonSituations":"Global httpx2 client options with follow_redirects=True reused across providers; an endpoint behind a redirecting load balancer.","solutions":["Disable follow_redirects for the Bedrock client.","If a redirect occurs, issue a new request to the target URL through the provider so it gets signed again.","Point base_url directly at the final (non-redirecting) endpoint."],"exampleFix":"// before\nclient = OpenAI(provider=bedrock(...), follow_redirects=True)\n\n// after\nclient = OpenAI(provider=bedrock(...), follow_redirects=False)","handlingStrategy":"validation","validationCode":"assert not client_options.get(\"follow_redirects\"), \"Bedrock SigV4 requires follow_redirects=False\"","typeGuard":"def is_redirect_safe(options: dict, using_sigv4: bool) -> bool:\n    return not using_sigv4 or not options.get(\"follow_redirects\")","tryCatchPattern":"try:\n    client = OpenAI(provider=bedrock(...), follow_redirects=True)\nexcept OpenAIError as e:\n    if \"redirects\" in str(e):\n        client = OpenAI(provider=bedrock(...), follow_redirects=False)\n    else:\n        raise","preventionTips":["Keep follow_redirects=False for AWS-signed clients.","Resolve redirecting endpoints to their final URL at config time.","Don't reuse generic httpx2 option presets across providers."],"tags":["bedrock","aws","sigv4","redirects"],"backgroundTag":"auth-redirect-unsupported","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}