{"record":{"id":"d22894ffb4ef458f","repo":"openai/openai-python","slug":"could-not-find-credentials-for-bedrock-set-aws-b","errorCode":null,"errorMessage":"Could not find credentials for Bedrock. Set `AWS_BEARER_TOKEN_BEDROCK` or configure the default AWS credential chain.","messagePattern":"Could not find credentials for Bedrock\\. Set `AWS_BEARER_TOKEN_BEDROCK` or configure the default AWS credential chain\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"critical","filePath":"src/openai/lib/bedrock.py","lineNumber":120,"sourceCode":"    aws_session_token: str | None,\n    aws_credentials_provider: AwsCredentialsProvider | None,\n) -> bool:\n    return any(\n        value is not None\n        for value in (\n            aws_profile,\n            aws_access_key_id,\n            aws_secret_access_key,\n            aws_session_token,\n            aws_credentials_provider,\n        )\n    )\n\n\ndef _environment_bearer_token() -> str:\n    token = os.environ.get(\"AWS_BEARER_TOKEN_BEDROCK\")\n    if not token:\n        raise OpenAIError(\n            \"Could not find credentials for Bedrock. Set `AWS_BEARER_TOKEN_BEDROCK` or configure the default \"\n            \"AWS credential chain.\"\n        )\n    return token\n\n\ndef _legacy_provider(\n    *,\n    api_key: str | None,\n    token_provider: BedrockTokenProvider | AsyncBedrockTokenProvider | None,\n    aws_region: str | None,\n    aws_profile: str | None,\n    aws_access_key_id: str | None,\n    aws_secret_access_key: str | None,\n    aws_session_token: str | None,\n    aws_credentials_provider: AwsCredentialsProvider | None,\n    base_url: str | httpx2.URL | None,\n    region_was_explicit: bool | None = None,","sourceCodeStart":102,"sourceCodeEnd":138,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/lib/bedrock.py#L102-L138","documentation":"The Bedrock OpenAI client falls back to the AWS_BEARER_TOKEN_BEDROCK environment variable for bearer-token auth when no explicit api_key was provided, and that variable is empty/unset, so no credential could be resolved.","triggerScenarios":"Creating a Bedrock-configured client without api_key or AWS_BEARER_TOKEN_BEDROCK; the env var set but empty (e.g. `AWS_BEARER_TOKEN_BEDROCK=` in .env); called from _copy_configuration during with_options() when the original client relied on the env token.","commonSituations":"Missing env var in CI/containers, empty-string env entries in compose files, or relying on the default AWS credential chain where only bearer-token auth is supported for this path.","solutions":["Export AWS_BEARER_TOKEN_BEDROCK with your Bedrock bearer token","Or pass api_key explicitly when constructing the client","If using SigV4-style default AWS credentials, ensure the client is configured for that chain and a bearer token is not required"],"exampleFix":"# before\nclient = OpenAI(provider=Provider.bedrock)  # no bearer token anywhere\n# after\n# export AWS_BEARER_TOKEN_BEDROCK=...\nclient = OpenAI(provider=Provider.bedrock, api_key=os.environ[\"AWS_BEARER_TOKEN_BEDROCK\"])","handlingStrategy":"validation","validationCode":"import os\nbearer = os.environ.get(\"AWS_BEARER_TOKEN_BEDROCK\", \"\").strip()\nif not bearer:\n    raise RuntimeError(\"AWS_BEARER_TOKEN_BEDROCK is required for Bedrock bearer auth\")","typeGuard":null,"tryCatchPattern":"try:\n    client = OpenAI(provider=Provider.bedrock)\nexcept OpenAIError as e:\n    if \"AWS_BEARER_TOKEN_BEDROCK\" in str(e):\n        raise ConfigError(str(e)) from e\n    raise","preventionTips":["Export AWS_BEARER_TOKEN_BEDROCK in all deployment envs","Watch for empty-string env vars in compose files","Pass api_key explicitly when possible"],"tags":["bedrock","aws","credentials","env-var","authentication"],"backgroundTag":"missing-credentials","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}