openai/openai-python · error · OpenAIError

Bedrock authentication is ambiguous. Configure exactly one e

Error message

Bedrock authentication is ambiguous. Configure exactly one explicit AWS mode: static credentials, profile, or credential provider.

What it means

Multiple explicit AWS SigV4 authentication modes were configured at once: static credentials (access_key_id/secret_access_key), a named `profile`, and/or a `credential_provider`. The SDK cannot pick between them, so it raises this OpenAIError asking for exactly one.

Source

Thrown at src/openai/providers/bedrock.py:455

    if session_token is not None and not session_token.strip():
        raise OpenAIError("A static AWS `session_token` must not be empty when provided.")

    explicit_api_key = not isinstance(api_key, NotGiven) and api_key is not None
    if explicit_api_key and (not isinstance(api_key, str) or not api_key.strip()):
        raise OpenAIError("The Bedrock bearer credential must not be empty.")
    if explicit_api_key and token_provider is not None:
        raise OpenAIError("The `api_key` and `token_provider` options are mutually exclusive. Configure only one.")

    explicit_bearer = explicit_api_key or token_provider is not None
    aws_modes = sum(
        (
            access_key_id is not None,
            normalized_profile is not None,
            credential_provider is not None,
        )
    )
    if aws_modes > 1:
        raise OpenAIError(
            "Bedrock authentication is ambiguous. Configure exactly one explicit AWS mode: static credentials, "
            "profile, or credential provider."
        )
    if explicit_bearer and aws_modes:
        raise OpenAIError(
            "Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, "
            "static AWS credentials, profile, or credential provider."
        )

    skip_environment_bearer = not isinstance(api_key, NotGiven) and api_key is None
    use_environment_bearer = (
        not explicit_bearer
        and not aws_modes
        and not skip_environment_bearer
        and bool(os.environ.get("AWS_BEARER_TOKEN_BEDROCK"))
    )

    if normalized_region is None and (configured_base_url is None or not (explicit_bearer or use_environment_bearer)):

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Keep exactly one AWS mode: either static keys, profile, or credential_provider
2. Centralize credential choice in one config layer and remove the duplicates
3. If keys come from env, pass profile=None explicitly to suppress config-file resolution

Example fix

# before
bedrock(access_key_id=ak, secret_access_key=sk, profile='prod')
# after
bedrock(access_key_id=ak, secret_access_key=sk)

aws_modes = [bool(access_key_id), bool(profile), credential_provider is not None]
if sum(aws_modes) > 1:
    raise ValueError('multiple AWS auth modes configured')

def single_aws_mode(ak, profile, cp) -> bool:
    return sum([ak is not None, profile is not None, cp is not None]) <= 1

When it happens

Trigger: bedrock(access_key_id=..., secret_access_key=..., profile='prod') or profile plus credential_provider, or all three.

Common situations: A base config sets a profile while deployment code injects static keys (or vice versa); env-var plumbing sets AWS_PROFILE while code also passes explicit keys.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• The Bedrock AWS `profile` must not be empty.
• Static AWS credentials require both `access_key_id` and `sec
• Static AWS credentials require non-empty `access_key_id` and
• A static AWS `session_token` must not be empty when provided
• Bedrock authentication is ambiguous. Configure exactly one e

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/78386a952eea7530. Report an issue: GitHub.