{"record":{"id":"9fb3a7a0e2bd1042","repo":"openai/openai-python","slug":"the-api-key-and-token-provider-options-are-mut","errorCode":null,"errorMessage":"The `api_key` and `token_provider` options are mutually exclusive. Configure only one.","messagePattern":"The `api_key` and `token_provider` options are mutually exclusive\\. Configure only one\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":444,"sourceCode":"    normalized_profile = _normalize_optional_string(profile)\n    if profile is not None and normalized_profile is None:\n        raise OpenAIError(\"The Bedrock AWS `profile` must not be empty.\")\n\n    if (access_key_id is None) != (secret_access_key is None) or (session_token is not None and access_key_id is None):\n        raise OpenAIError(\n            \"Static AWS credentials require both `access_key_id` and `secret_access_key`. \"\n            \"A `session_token` may only be used with both.\"\n        )\n    if access_key_id is not None and (not access_key_id.strip() or not cast(str, secret_access_key).strip()):\n        raise OpenAIError(\"Static AWS credentials require non-empty `access_key_id` and `secret_access_key` values.\")\n    if session_token is not None and not session_token.strip():\n        raise OpenAIError(\"A static AWS `session_token` must not be empty when provided.\")\n\n    explicit_api_key = not isinstance(api_key, NotGiven) and api_key is not None\n    if explicit_api_key and (not isinstance(api_key, str) or not api_key.strip()):\n        raise OpenAIError(\"The Bedrock bearer credential must not be empty.\")\n    if explicit_api_key and token_provider is not None:\n        raise OpenAIError(\"The `api_key` and `token_provider` options are mutually exclusive. Configure only one.\")\n\n    explicit_bearer = explicit_api_key or token_provider is not None\n    aws_modes = sum(\n        (\n            access_key_id is not None,\n            normalized_profile is not None,\n            credential_provider is not None,\n        )\n    )\n    if aws_modes > 1:\n        raise OpenAIError(\n            \"Bedrock authentication is ambiguous. Configure exactly one explicit AWS mode: static credentials, \"\n            \"profile, or credential provider.\"\n        )\n    if explicit_bearer and aws_modes:\n        raise OpenAIError(\n            \"Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, \"\n            \"static AWS credentials, profile, or credential provider.\"","sourceCodeStart":426,"sourceCodeEnd":462,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L426-L462","documentation":"`api_key` (bearer auth) and `token_provider` (programmatic bearer tokens) both configure Bedrock bearer authentication, so passing both is ambiguous and rejected. Configure exactly one bearer mechanism.","triggerScenarios":"bedrock(api_key='...', token_provider=my_provider) — e.g. wrapping OpenAIAuth with a static key left over in config while also wiring a token provider.","commonSituations":"Migrating from static keys to a token provider and forgetting to remove the old key, or a shared config helper that always sets api_key.","solutions":["Remove api_key when using token_provider (or set api_key=None to explicitly disable env fallback)","If you only need a static token, drop token_provider"],"exampleFix":"# before\nbedrock(api_key=os.environ.get('OPENAI_API_KEY'), token_provider=provider)\n# after\nbedrock(api_key=None, token_provider=provider)","handlingStrategy":"validation","validationCode":"if api_key and token_provider is not None:\n    raise ValueError('choose api_key or token_provider, not both')","typeGuard":"def single_bearer_mode(api_key: object, token_provider: object) -> bool:\n    return not (api_key and token_provider is not None)","tryCatchPattern":null,"preventionTips":["When adding a token provider, explicitly set api_key=None","Keep auth wiring in one place"],"tags":["bedrock","auth","mutually-exclusive","validation"],"backgroundTag":"conflicting-auth-options","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}