{"record":{"id":"d70ad120749f5910","repo":"openai/openai-python","slug":"bedrock-authentication-is-ambiguous-configure-exa-d70ad1","errorCode":null,"errorMessage":"Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, static AWS credentials, profile, or credential provider.","messagePattern":"Bedrock authentication is ambiguous\\. Configure exactly one explicit mode: bearer credential, static AWS credentials, profile, or credential provider\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":460,"sourceCode":"        raise OpenAIError(\"The Bedrock bearer credential must not be empty.\")\n    if explicit_api_key and token_provider is not None:\n        raise OpenAIError(\"The `api_key` and `token_provider` options are mutually exclusive. Configure only one.\")\n\n    explicit_bearer = explicit_api_key or token_provider is not None\n    aws_modes = sum(\n        (\n            access_key_id is not None,\n            normalized_profile is not None,\n            credential_provider is not None,\n        )\n    )\n    if aws_modes > 1:\n        raise OpenAIError(\n            \"Bedrock authentication is ambiguous. Configure exactly one explicit AWS mode: static credentials, \"\n            \"profile, or credential provider.\"\n        )\n    if explicit_bearer and aws_modes:\n        raise OpenAIError(\n            \"Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, \"\n            \"static AWS credentials, profile, or credential provider.\"\n        )\n\n    skip_environment_bearer = not isinstance(api_key, NotGiven) and api_key is None\n    use_environment_bearer = (\n        not explicit_bearer\n        and not aws_modes\n        and not skip_environment_bearer\n        and bool(os.environ.get(\"AWS_BEARER_TOKEN_BEDROCK\"))\n    )\n\n    if normalized_region is None and (configured_base_url is None or not (explicit_bearer or use_environment_bearer)):\n        normalized_region = _normalize_optional_string(\n            os.environ.get(\"AWS_REGION\") or os.environ.get(\"AWS_DEFAULT_REGION\")\n        )\n        _validate_bedrock_region(normalized_region)\n        if normalized_region is not None:","sourceCodeStart":442,"sourceCodeEnd":478,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L442-L478","documentation":"A bearer mechanism (`api_key` or `token_provider`) was combined with an explicit AWS SigV4 mode (static credentials, profile, or credential_provider). Bedrock supports either bearer or AWS signing, not both, so the combination is rejected as ambiguous.","triggerScenarios":"bedrock(api_key='...', profile='default'), or token_provider plus static access_key_id/secret_access_key.","commonSituations":"Copy-pasting a general OpenAI client setup (which sets api_key) into a Bedrock workflow that already configures AWS credentials, or leftover OPENAI_API_KEY being forwarded while AWS keys are explicit.","solutions":["Decide one auth model: bearer (api_key/token_provider) or AWS SigV4 (keys/profile/provider)","Pass api_key=None to explicitly disable environment bearer pickup when using AWS credentials"],"exampleFix":"# before\nbedrock(api_key=os.environ.get('OPENAI_API_KEY'), access_key_id=ak, secret_access_key=sk)\n# after\nbedrock(api_key=None, access_key_id=ak, secret_access_key=sk)","handlingStrategy":"validation","validationCode":"bearer = bool(api_key) or token_provider is not None\naws = any([access_key_id, profile, credential_provider])\nif bearer and aws:\n    raise ValueError('bearer and AWS auth are mutually exclusive')","typeGuard":"def non_ambiguous_auth(api_key, tp, ak, profile, cp) -> bool:\n    bearer = api_key or tp is not None\n    aws = ak is not None or profile is not None or cp is not None\n    return not (bearer and aws)","tryCatchPattern":null,"preventionTips":["Don't reuse generic OpenAI client kwargs for Bedrock","Set api_key=None explicitly in AWS-auth setups"],"tags":["bedrock","auth","ambiguous-auth","validation"],"backgroundTag":"conflicting-auth-options","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}