openai/openai-python · error · OpenAIError

Bedrock authentication is ambiguous. Configure exactly one e

Error message

Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, static AWS credentials, profile, or credential provider.

What it means

Bedrock authentication supports exactly one explicit mode. This variant fires when both a bearer credential (`api_key`) and a token provider (`bedrock_token_provider`) are supplied at construction time.

Source

Thrown at src/openai/lib/bedrock.py:145

def _legacy_provider(
    *,
    api_key: str | None,
    token_provider: BedrockTokenProvider | AsyncBedrockTokenProvider | None,
    aws_region: str | None,
    aws_profile: str | None,
    aws_access_key_id: str | None,
    aws_secret_access_key: str | None,
    aws_session_token: str | None,
    aws_credentials_provider: AwsCredentialsProvider | None,
    base_url: str | httpx2.URL | None,
    region_was_explicit: bool | None = None,
) -> tuple[_Provider, _LegacyBedrockState, str]:
    if callable(cast(object, api_key)):
        raise OpenAIError("Pass refreshable Bedrock credentials via `bedrock_token_provider`, not `api_key`.")
    if api_key == "":
        raise OpenAIError("The `api_key` argument must not be empty.")
    if api_key is not None and token_provider is not None:
        raise OpenAIError(
            "Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, "
            "static AWS credentials, profile, or credential provider."
        )

    explicit_aws_auth = _has_explicit_aws_auth(
        aws_profile=aws_profile,
        aws_access_key_id=aws_access_key_id,
        aws_secret_access_key=aws_secret_access_key,
        aws_session_token=aws_session_token,
        aws_credentials_provider=aws_credentials_provider,
    )
    if (api_key is not None or token_provider is not None) and explicit_aws_auth:
        raise OpenAIError(
            "Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, "
            "static AWS credentials, profile, or credential provider."
        )

    environment_token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Remove `api_key` and keep only `bedrock_token_provider`
2. If the token is static, remove `bedrock_token_provider` and keep `api_key`

Example fix

# before
client = BedrockOpenAI(api_key='static-token', bedrock_token_provider=refresh_fn)
# after
client = BedrockOpenAI(bedrock_token_provider=refresh_fn)

assert not (api_key is not None and token_provider is not None), 'choose one auth mode'

When it happens

Trigger: `BedrockOpenAI(api_key='token', bedrock_token_provider=fn)` — both a non-None `api_key` and a non-None `token_provider` in the same constructor call.

Common situations: Migrating incrementally to `bedrock_token_provider` while leaving the old `api_key` argument in place; defaults from a shared config dict that sets both fields.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Could not find credentials for Bedrock. Set `AWS_BEARER_TOKE
• Pass refreshable Bedrock credentials via `bedrock_token_prov
• The `api_key` argument must not be empty.
• The Bedrock bearer credential must not be empty.
• Expected `bedrock_token_provider` argument to return a non-e

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/1bb41a6708b86684. Report an issue: GitHub.