{"record":{"id":"b09edc58abed2867","repo":"openai/openai-python","slug":"could-not-resolve-authentication-method-expected","errorCode":null,"errorMessage":"\"Could not resolve authentication method. Expected either api_key or admin_api_key to be set. Or for one of the `Authorization` or `Authorization` headers to be explicitly omitted\"","messagePattern":"\"Could not resolve authentication method\\. Expected either api_key or admin_api_key to be set\\. Or for one of the `Authorization` or `Authorization` headers to be explicitly omitted\"","errorType":"validation","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/openai/_client.py","lineNumber":646,"sourceCode":"    @override\n    def default_headers(self) -> dict[str, str | Omit]:\n        return {\n            **super().default_headers,\n            \"X-Stainless-Async\": \"false\",\n            \"OpenAI-Organization\": self.organization if self.organization is not None else Omit(),\n            \"OpenAI-Project\": self.project if self.project is not None else Omit(),\n            **self._custom_headers,\n        }\n\n    @override\n    def _validate_headers(self, headers: Headers, custom_headers: Headers) -> None:\n        if self._provider_runtime is not None:\n            return\n\n        if _has_header(headers, \"Authorization\") or _has_omitted_header(custom_headers, \"Authorization\"):\n            return\n\n        raise TypeError(\n            '\"Could not resolve authentication method. Expected either api_key or admin_api_key to be set. Or for one of the `Authorization` or `Authorization` headers to be explicitly omitted\"'\n        )\n\n    @override\n    def _prepare_options(self, options: FinalRequestOptions) -> FinalRequestOptions:\n        if self._provider_runtime is not None:\n            if self._provider_runtime.transform_request is not None:\n                options = self._provider_runtime.transform_request(options)\n        elif self._api_key_provider is not None and options.security.get(\"bearer_auth\", False):\n            self._refresh_api_key()\n\n        return super()._prepare_options(options)\n\n    @override\n    def _prepare_request(self, request: httpx2.Request) -> None:\n        if self._provider_runtime is not None and self._provider_runtime.prepare_request is not None:\n            self._provider_runtime.prepare_request(request)\n","sourceCodeStart":628,"sourceCodeEnd":664,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/_client.py#L628-L664","documentation":"_validate_headers requires a resolvable credential: `api_key`, `admin_api_key`, an api-key provider, a provider runtime, or an explicitly provided/omitted `Authorization` header. If none exist, each request fails fast with this TypeError (note the duplicated header name in the message is a known quirk).","triggerScenarios":"`OpenAI(api_key=None)` with no env var but with `default_headers={'X-Foo':'bar'}`; admin clients without `OPENAI_ADMIN_KEY`; explicitly passing `api_key=''`; usage where only custom auth headers were expected but none supplied.","commonSituations":"Same as missing-credential cases but surfacing at request time via header validation; proxies that inject auth later so the SDK is built key-less without omitting Authorization.","solutions":["Supply `api_key`/`admin_api_key` or set `OPENAI_API_KEY`/`OPENAI_ADMIN_KEY`","If an upstream proxy adds auth, explicitly omit the header: `OpenAI(default_headers={'Authorization': Omit})` per docs","Use `with_raw_response`-safe custom auth via `http_client` request hooks instead of leaving auth unresolved"],"exampleFix":"# before\nclient = OpenAI()  # no key anywhere\n\n# after (proxy injects auth)\nfrom openai._utils import Omit\nclient = OpenAI(default_headers={'Authorization': Omit})","handlingStrategy":"validation","validationCode":"import os\nhas_creds = bool(client.api_key or client.admin_api_key or os.environ.get('OPENAI_API_KEY'))\nif not has_creds:\n    raise ValueError('No auth configured for requests')","typeGuard":null,"tryCatchPattern":"try:\n    models = client.models.list()\nexcept TypeError as e:\n    if 'Could not resolve authentication method' in str(e):\n        raise SystemExit('Set OPENAI_API_KEY or explicitly omit the Authorization header') from e\n    raise","preventionTips":["When a proxy handles auth, pass default_headers={'Authorization': Omit} explicitly","Validate credentials at client construction time, not on first request in production paths"],"tags":["auth","headers","api-key","validation"],"backgroundTag":"missing-api-key","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}