openai/openai-python · error · OpenAIError

Bedrock authentication is ambiguous. Configure exactly one e

Error message

Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, static AWS credentials, profile, or credential provider.

What it means

A bearer mechanism (`api_key` or `token_provider`) was combined with an explicit AWS SigV4 mode (static credentials, profile, or credential_provider). Bedrock supports either bearer or AWS signing, not both, so the combination is rejected as ambiguous.

Source

Thrown at src/openai/providers/bedrock.py:460

        raise OpenAIError("The Bedrock bearer credential must not be empty.")
    if explicit_api_key and token_provider is not None:
        raise OpenAIError("The `api_key` and `token_provider` options are mutually exclusive. Configure only one.")

    explicit_bearer = explicit_api_key or token_provider is not None
    aws_modes = sum(
        (
            access_key_id is not None,
            normalized_profile is not None,
            credential_provider is not None,
        )
    )
    if aws_modes > 1:
        raise OpenAIError(
            "Bedrock authentication is ambiguous. Configure exactly one explicit AWS mode: static credentials, "
            "profile, or credential provider."
        )
    if explicit_bearer and aws_modes:
        raise OpenAIError(
            "Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, "
            "static AWS credentials, profile, or credential provider."
        )

    skip_environment_bearer = not isinstance(api_key, NotGiven) and api_key is None
    use_environment_bearer = (
        not explicit_bearer
        and not aws_modes
        and not skip_environment_bearer
        and bool(os.environ.get("AWS_BEARER_TOKEN_BEDROCK"))
    )

    if normalized_region is None and (configured_base_url is None or not (explicit_bearer or use_environment_bearer)):
        normalized_region = _normalize_optional_string(
            os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")
        )
        _validate_bedrock_region(normalized_region)
        if normalized_region is not None:

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Decide one auth model: bearer (api_key/token_provider) or AWS SigV4 (keys/profile/provider)
2. Pass api_key=None to explicitly disable environment bearer pickup when using AWS credentials

Example fix

# before
bedrock(api_key=os.environ.get('OPENAI_API_KEY'), access_key_id=ak, secret_access_key=sk)
# after
bedrock(api_key=None, access_key_id=ak, secret_access_key=sk)

bearer = bool(api_key) or token_provider is not None
aws = any([access_key_id, profile, credential_provider])
if bearer and aws:
    raise ValueError('bearer and AWS auth are mutually exclusive')

def non_ambiguous_auth(api_key, tp, ak, profile, cp) -> bool:
    bearer = api_key or tp is not None
    aws = ak is not None or profile is not None or cp is not None
    return not (bearer and aws)

When it happens

Trigger: bedrock(api_key='...', profile='default'), or token_provider plus static access_key_id/secret_access_key.

Common situations: Copy-pasting a general OpenAI client setup (which sets api_key) into a Bedrock workflow that already configures AWS credentials, or leftover OPENAI_API_KEY being forwarded while AWS keys are explicit.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• The `api_key` and `token_provider` options are mutually excl
• Bedrock authentication is ambiguous. Configure exactly one e
• Invalid `workload_identity` configuration: expected an X.509
• "Could not resolve authentication method. Expected either ap
• The `api_key` argument must not be empty.

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/d70ad120749f5910. Report an issue: GitHub.