{"record":{"id":"fff281997b481819","repo":"remotion-dev/remotion","slug":"cannot-specify-both-session-and-explicit-credent","errorCode":null,"errorMessage":"Cannot specify both 'session' and explicit credentials ('access_key'/'secret_key'). Please use only 'session'.","messagePattern":"Cannot specify both 'session' and explicit credentials \\('access_key'/'secret_key'\\)\\. Please use only 'session'\\.","errorType":"validation","errorClass":"RemotionInvalidArgumentException","httpStatus":null,"severity":"error","filePath":"packages/lambda-python/remotion_lambda/remotionclient.py","lineNumber":176,"sourceCode":"        ...     region='us-east-1',\n        ...     serve_url='https://api.example.com',\n        ...     function_name='my-function',\n        ...     access_key='AKIA...',\n        ...     secret_key='secret...'\n        ... )\n        \"\"\"\n       # Validate required parameters at construction time\n        if not region or not region.strip():\n            raise RemotionInvalidArgumentException(\"'region' parameter is required and cannot be empty or whitespace\")\n        if not serve_url or not serve_url.strip():\n            raise RemotionInvalidArgumentException(\"'serve_url' parameter is required and cannot be empty or whitespace\")\n        if not function_name or not function_name.strip():\n            raise RemotionInvalidArgumentException(\"'function_name' parameter is required and cannot be empty or whitespace\")\n\n\n        # Check for conflicting authentication methods\n        if session and (access_key or secret_key):\n            raise RemotionInvalidArgumentException(\n                \"Cannot specify both 'session' and explicit credentials \"\n                \"('access_key'/'secret_key'). Please use only 'session'.\"\n            )\n\n        # Handle deprecated credential parameters\n        if access_key is not None or secret_key is not None:\n            warnings.warn(\n                \"Parameters 'access_key' and 'secret_key' are deprecated \"\n                \"as of version 4.0.376 and will be removed in version 5.0.0. \"\n                \"Please migrate to using 'session' for improved security. \",\n                DeprecationWarning,\n                stacklevel=2,\n            )\n            # Validate both keys are provided together\n            if access_key and not secret_key:\n                raise RemotionInvalidArgumentException(\"'secret_key' must be provided when 'access_key' is specified\")\n            if secret_key and not access_key:\n                raise RemotionInvalidArgumentException(\"'access_key' must be provided when 'secret_key' is specified\")","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/remotion-dev/remotion/blob/78fe4bb3fdb5a2cd68724393d63cb223db333fa7/packages/lambda-python/remotion_lambda/remotionclient.py#L158-L194","documentation":"Raised when the caller passes both a boto3 Session (the recommended auth method) and explicit access_key/secret_key credentials to the Python RemotionClient constructor. The library disallows mixing auth methods to avoid ambiguity about which credentials AWS will actually use.","triggerScenarios":"Passing session=<boto3.Session(...)> together with access_key=..., or session=... plus secret_key=... The check fires whenever session is truthy AND at least one of access_key/secret_key is set.","commonSituations":"Migrating from explicit credentials to a Session but forgetting to remove the old access_key/secret_key kwargs; copy-pasting example code that combines both styles; loading a session from a shared utility while still passing credentials from env.","solutions":["Pick ONE auth method: pass either session=... OR access_key/secret_key, never both.","When migrating to a Session, delete the access_key and secret_key arguments entirely.","If a Session already encapsulates credentials, do not also pass credentials as kwargs."],"exampleFix":"// before\nsession = boto3.Session()\nclient = RemotionClient(\n    region=region,\n    serve_url=serve_url,\n    function_name=fn,\n    session=session,\n    access_key=os.environ['AWS_ACCESS_KEY_ID'],  # conflict\n)\n\n# after\nclient = RemotionClient(\n    region=region,\n    serve_url=serve_url,\n    function_name=fn,\n    session=session,\n)","handlingStrategy":"validation","validationCode":"def validate_auth_args(session, access_key, secret_key):\n    if session is not None and (access_key is not None or secret_key is not None):\n        raise ValueError('Pass either session= OR access_key/secret_key, not both')\n    return True","typeGuard":"def uses_single_auth_method(session, access_key, secret_key) -> bool:\\n    return not (session is not None and (access_key is not None or secret_key is not None))","tryCatchPattern":"try:\\n    client = RemotionClient(region=region, serve_url=serve_url, function_name=fn, session=session)\\nexcept RemotionInvalidArgumentException as e:\\n    raise SystemExit(f'Auth conflict: {e}')","preventionTips":["Standardize on boto3.Session for all credentials.","When migrating, remove access_key/secret_key kwargs explicitly.","Audit constructor calls in code review for mixed auth args."],"tags":["python","validation","authentication","aws-credentials","session"],"backgroundTag":null,"analyzedSha":"78fe4bb3fdb5a2cd68724393d63cb223db333fa7","analyzedAt":"2026-08-12T17:18:50.444Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}