openai/openai-python · error · OpenAIError

AsyncBedrockOpenAI only supports Bedrock bearer token or AWS

Error message

AsyncBedrockOpenAI only supports Bedrock bearer token or AWS credential authentication.

What it means

The async Bedrock client's `copy()` rejects `admin_api_key` and `workload_identity`. AsyncBedrockOpenAI supports only Bedrock bearer tokens or AWS credentials; platform-admin and workload-identity auth are first-party OpenAI features.

Source

Thrown at src/openai/lib/bedrock.py:811

        timeout: float | Timeout | None | NotGiven = NOT_GIVEN,
        http_client: httpx2.AsyncClient | None = None,
        max_retries: int | NotGiven = NOT_GIVEN,
        default_headers: Mapping[str, str] | None = None,
        set_default_headers: Mapping[str, str] | None = None,
        default_query: Mapping[str, object] | None = None,
        set_default_query: Mapping[str, object] | None = None,
        _enforce_credentials: bool | None = None,
        _extra_kwargs: Mapping[str, Any] = {},
    ) -> Self:
        if data_residency is not None:
            raise OpenAIError("`data_residency` is only supported by OpenAI clients")
        base_url = None if isinstance(base_url, NotGiven) else base_url
        if callable(api_key):
            raise OpenAIError("Pass refreshable Bedrock credentials via `bedrock_token_provider`, not `api_key`.")
        if not isinstance(provider, NotGiven):
            raise OpenAIError("Configure `provider` on `AsyncOpenAI`, not on `AsyncBedrockOpenAI.with_options()`.")
        if admin_api_key is not None or workload_identity is not None:
            raise OpenAIError("AsyncBedrockOpenAI only supports Bedrock bearer token or AWS credential authentication.")
        if default_headers is not None and set_default_headers is not None:
            raise ValueError("The `default_headers` and `set_default_headers` arguments are mutually exclusive")
        if default_query is not None and set_default_query is not None:
            raise ValueError("The `default_query` and `set_default_query` arguments are mutually exclusive")

        headers = self._custom_headers
        if default_headers is not None:
            headers = {**headers, **default_headers}
        elif set_default_headers is not None:
            headers = set_default_headers
        params = self._custom_query
        if default_query is not None:
            params = {**params, **default_query}
        elif set_default_query is not None:
            params = set_default_query

        provider_kwargs, inherited_provider, inherited_state = _copy_configuration(
            self,

View on GitHub (pinned to 9917c6e28e)

Solutions

Remove these arguments from Bedrock calls
Use `AsyncOpenAI(admin_api_key=...)` for admin operations
Authenticate Bedrock with `api_key`, `bedrock_token_provider`, or `aws_*` credentials

Example fix

# before
admin = async_bedrock_client.with_options(admin_api_key=ADMIN_KEY)
# after
from openai import AsyncOpenAI
admin = AsyncOpenAI(admin_api_key=ADMIN_KEY)

Defensive patterns

Strategy: validation

Validate before calling

for k in ('admin_api_key','workload_identity'):
    assert kwargs.get(k) is None

Prevention

Use AsyncOpenAI for admin/workload-identity auth

When it happens

Trigger: `async_bedrock_client.with_options(admin_api_key='...')` or `with_options(workload_identity=...)` — either non-None.

Common situations: Shared async config objects applied across client types; migrating platform automation to a Bedrock endpoint.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/af67e060a2b3cbdf. Report an issue: GitHub.