{"record":{"id":"e9b73be1f4eb36c5","repo":"openai/openai-python","slug":"refusing-to-sign-a-bedrock-request-for-an-origin-o","errorCode":null,"errorMessage":"Refusing to sign a Bedrock request for an origin other than the configured provider URL.","messagePattern":"Refusing to sign a Bedrock request for an origin other than the configured provider URL\\.","errorType":"error_code","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":208,"sourceCode":"        request.headers[\"Authorization\"] = f\"Bearer {await self._resolve_token_async()}\"\n\n\nclass _BedrockSigV4Auth:\n    def __init__(\n        self,\n        *,\n        config: BedrockAwsAuthConfig,\n        base_url: httpx2.URL,\n        auth: BedrockAwsAuth | None = None,\n    ) -> None:\n        self._config = config\n        self._base_url = base_url\n        self._auth = auth\n\n    def _validate_request(self, request: httpx2.Request) -> bytes:\n        _assert_provider_owns_authorization(request)\n        if not _same_origin(request.url, self._base_url):\n            raise OpenAIError(\n                \"Refusing to sign a Bedrock request for an origin other than the configured provider URL.\"\n            )\n\n        canonical_endpoint = _parse_bedrock_endpoint_hostname(request.url.host)\n        if canonical_endpoint is not None:\n            endpoint, region = canonical_endpoint\n            expected_endpoint = \"runtime\" if self._config.service == \"bedrock\" else \"mantle\"\n            if endpoint != expected_endpoint:\n                raise OpenAIError(\n                    f\"The Bedrock {endpoint} hostname does not match the selected `{expected_endpoint}` endpoint.\"\n                )\n            if region != self._config.region:\n                raise OpenAIError(\n                    f\"The Bedrock endpoint region `{region}` does not match the SigV4 region `{self._config.region}`.\"\n                )\n\n        return _body_for_signing(request)\n","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L190-L226","documentation":"The SigV4 auth's request validator (used by both sync and async prepare paths) requires the request URL's origin to equal the provider's configured base_url origin before it will sign. Signing a request to an arbitrary origin with your AWS credentials would leak them, so it raises instead.","triggerScenarios":"base_url without a host (relative path) making httpx2 resolve the request against a different default origin; or custom transports/interceptors redirecting the URL to another host before signing.","commonSituations":"Migrating Azure-style path-only base_url usage to Bedrock; trailing-slash or scheme typos; a proxy layer rewriting hosts.","solutions":["Provide a fully-qualified base_url with scheme and host (https://bedrock-runtime.<region>.amazonaws.com).","Verify no code mutates request.url between client and provider."],"exampleFix":"# before\nprovider = bedrock(region=\"us-east-1\", base_url=\"bedrock-runtime\")\n\n# after\nprovider = bedrock(region=\"us-east-1\", base_url=\"https://bedrock-runtime.us-east-1.amazonaws.com\")","handlingStrategy":"validation","validationCode":"from httpx2 import URL\nu = URL(base_url)\nassert u.scheme and u.host, \"base_url must include scheme and host\"","typeGuard":"def is_absolute_url(base_url: str) -> bool:\n    u = URL(base_url)\n    return bool(u.scheme and u.host)","tryCatchPattern":"try:\n    client = OpenAI(provider=bedrock(region=region, base_url=base_url, aws_credentials=creds))\nexcept OpenAIError as e:\n    if \"origin\" in str(e):\n        client = OpenAI(provider=bedrock(region=region, aws_credentials=creds))\n    else:\n        raise","preventionTips":["Use absolute https URLs for provider base_url.","Avoid interceptors that rewrite request hosts before signing.","Centralize base_url construction in one config module."],"tags":["bedrock","aws","sigv4","origin","base-url"],"backgroundTag":"credential-origin-mismatch","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}