{"record":{"id":"c7a5310f593c404f","repo":"openai/openai-python","slug":"the-bedrock-bearer-credential-provider-must-return","errorCode":null,"errorMessage":"The Bedrock bearer credential provider must return a non-empty string.","messagePattern":"The Bedrock bearer credential provider must return a non-empty string\\.","errorType":"error_code","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":167,"sourceCode":"            raise OpenAIError(\n                \"Refusing to authenticate a Bedrock request for an origin other than the configured provider URL.\"\n            )\n\n    def _resolve_token(self) -> str:\n        try:\n            token = cast(object, self._token_provider())\n        except OpenAIError:\n            raise\n        except Exception as exc:\n            raise OpenAIError(\"Failed to resolve a bearer credential for Bedrock.\") from exc\n\n        if inspect.isawaitable(token):\n            close = getattr(token, \"close\", None)\n            if callable(close):\n                close()\n            raise OpenAIError(\"An async Bedrock token provider requires `AsyncOpenAI`.\")\n        if not isinstance(token, str) or not token.strip():\n            raise OpenAIError(\"The Bedrock bearer credential provider must return a non-empty string.\")\n        return token\n\n    async def _resolve_token_async(self) -> str:\n        try:\n            token = cast(object, self._token_provider())\n            if inspect.isawaitable(token):\n                token = await token\n        except OpenAIError:\n            raise\n        except Exception as exc:\n            raise OpenAIError(\"Failed to resolve a bearer credential for Bedrock.\") from exc\n\n        if not isinstance(token, str) or not token.strip():\n            raise OpenAIError(\"The Bedrock bearer credential provider must return a non-empty string.\")\n        return token\n\n    def prepare_request(self, request: httpx2.Request) -> None:\n        self._validate_request(request)","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L149-L185","documentation":"After resolving a bearer credential, the provider validates it is a non-empty (non-whitespace) string. Returning None, an object, or an empty/blank string means there is no usable credential, so it refuses before sending an unauthenticated request that would just 403.","triggerScenarios":"A token provider returning None on failure, returning a dict/object token, or the environment variable AWS_BEARER_TOKEN_BEDROCK being set to whitespace; also a provider returning an empty string after stripping.","commonSituations":"Token provider with a bug returning None instead of raising; env var set to \"\" or spaces in CI; a token object that is not a plain str.","solutions":["Fix the provider to always return a real token string or raise a clear error.","Check AWS_BEARER_TOKEN_BEDROCK is set to an actual non-blank value.","If it returns an object, extract the token field: `return tok.access_token`."],"exampleFix":"# before\ndef token():\n    tok = maybe_get_token()\n    return tok  # None on miss\n\n# after\ndef token():\n    tok = maybe_get_token()\n    if tok is None:\n        raise OpenAIError(\"no token available\")\n    return tok","handlingStrategy":"validation","validationCode":"token = token_provider()\nassert isinstance(token, str) and token.strip(), \"token provider must return a non-empty string\"","typeGuard":"def is_valid_bearer_token(v: object) -> bool:\n    return isinstance(v, str) and bool(v.strip())","tryCatchPattern":"try:\n    client = OpenAI(provider=bedrock(bearer=token_fn))\nexcept OpenAIError as e:\n    if \"non-empty string\" in str(e):\n        raise RuntimeError(\"token provider returned no usable token\") from e\n    raise","preventionTips":["Make token providers raise on failure instead of returning None.","Extract .token/.access_token from credential objects before returning.","Assert env vars are non-blank in CI before running the app."],"tags":["bedrock","aws","bearer","validation"],"backgroundTag":"empty-credential-token","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}