{"record":{"id":"d2361e380c2d0b5d","repo":"openai/openai-python","slug":"failed-to-resolve-a-bearer-credential-for-bedrock","errorCode":null,"errorMessage":"Failed to resolve a bearer credential for Bedrock.","messagePattern":"Failed to resolve a bearer credential for Bedrock\\.","errorType":"error_code","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":159,"sourceCode":"class _BedrockBearerAuth:\n    def __init__(self, token_provider: BedrockTokenProvider, *, base_url: httpx2.URL) -> None:\n        self._token_provider = token_provider\n        self._base_url = base_url\n\n    def _validate_request(self, request: httpx2.Request) -> None:\n        _assert_provider_owns_authorization(request)\n        if not _same_origin(request.url, self._base_url):\n            raise OpenAIError(\n                \"Refusing to authenticate a Bedrock request for an origin other than the configured provider URL.\"\n            )\n\n    def _resolve_token(self) -> str:\n        try:\n            token = cast(object, self._token_provider())\n        except OpenAIError:\n            raise\n        except Exception as exc:\n            raise OpenAIError(\"Failed to resolve a bearer credential for Bedrock.\") from exc\n\n        if inspect.isawaitable(token):\n            close = getattr(token, \"close\", None)\n            if callable(close):\n                close()\n            raise OpenAIError(\"An async Bedrock token provider requires `AsyncOpenAI`.\")\n        if not isinstance(token, str) or not token.strip():\n            raise OpenAIError(\"The Bedrock bearer credential provider must return a non-empty string.\")\n        return token\n\n    async def _resolve_token_async(self) -> str:\n        try:\n            token = cast(object, self._token_provider())\n            if inspect.isawaitable(token):\n                token = await token\n        except OpenAIError:\n            raise\n        except Exception as exc:","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L141-L177","documentation":"The synchronous bearer token provider (a callable you passed or the env-token function) raised an unexpected exception while resolving the credential. The provider wraps it in OpenAIError with the original as __cause__, so the underlying failure (bad creds file, expired session, etc.) is preserved.","triggerScenarios":"A custom bearer callable raising anything other than OpenAIError during client.prepare_request, e.g. a botocore session failing to load SSO tokens.","commonSituations":"AWS SSO token expired; ~/.aws/credential cache unreadable; a custom token fetcher hitting a network error inside its callable.","solutions":["Inspect `exc.__cause__` to find the real failure and fix that (re-auth SSO, repair credentials).","Wrap your own token provider so it raises OpenAIError with a clear message if you want it surfaced directly.","Ensure environment (AWS_PROFILE, shared credentials) is set correctly where the process runs."],"exampleFix":"# before\ndef token():\n    return get_secret_from_vault()  # raises VaultError\n\n# after\ndef token():\n    try:\n        return get_secret_from_vault()\n    except VaultError as e:\n        raise OpenAIError(\"vault token fetch failed\") from e","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    client = OpenAI(provider=bedrock(bearer=token_fn))\nexcept OpenAIError as e:\n    cause = e.__cause__\n    if isinstance(cause, (TokenExpiredError, CredentialError)):\n        refresh_credentials(); client = OpenAI(provider=bedrock(bearer=token_fn))\n    else:\n        raise","preventionTips":["Wrap custom token providers to raise OpenAIError with actionable messages.","Refresh/cache credentials before client construction.","Log e.__cause__ whenever credential setup fails."],"tags":["bedrock","aws","bearer","credentials"],"backgroundTag":"credential-resolution-failed","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}