openai/openai-python · error · OpenAIError

Bedrock provider authentication cannot be combined with a cu

Error message

Bedrock provider authentication cannot be combined with a custom `Authorization` header.

What it means

The Bedrock provider signs or sets the Authorization header itself (SigV4 signature or bearer token). A request that already carries a user-supplied Authorization header would have it overwritten or double-authenticated, so the provider aborts before sending.

Source

Thrown at src/openai/providers/bedrock.py:128


def _same_origin(left: httpx2.URL, right: httpx2.URL) -> bool:
    return (left.scheme, left.host, left.port) == (right.scheme, right.host, right.port)


def _body_for_signing(request: httpx2.Request) -> bytes:
    try:
        return request.content
    except request_not_read_exceptions() as exc:
        raise OpenAIError(
            "Bedrock SigV4 authentication requires a replayable request body. "
            "Buffer the body before sending or use bearer authentication."
        ) from exc


def _assert_provider_owns_authorization(request: httpx2.Request) -> None:
    if "Authorization" in request.headers:
        raise OpenAIError("Bedrock provider authentication cannot be combined with a custom `Authorization` header.")


def _without_redirects(options: FinalRequestOptions) -> FinalRequestOptions:
    if options.follow_redirects:
        raise OpenAIError(
            "Bedrock SigV4 authentication does not support automatic redirects. "
            "Send a new request to the redirect target so it can be signed again."
        )
    options.follow_redirects = False
    return options


class _BedrockBearerAuth:
    def __init__(self, token_provider: BedrockTokenProvider, *, base_url: httpx2.URL) -> None:
        self._token_provider = token_provider
        self._base_url = base_url

    def _validate_request(self, request: httpx2.Request) -> None:

View on GitHub (pinned to 9917c6e28e)

Solutions

Remove the Authorization header from default_headers/extra_headers and let the provider inject credentials.
If you truly need your own bearer token, supply it via the provider's bearer credential configuration instead of a raw header.

Example fix

// before
client = OpenAI(provider=bedrock(...), default_headers={"Authorization": f"Bearer {tok}"})

// after
client = OpenAI(provider=bedrock(bearer=...))

Defensive patterns

Strategy: validation

Validate before calling

headers.pop("Authorization", None)  # before constructing the bedrock client
assert "Authorization" not in (default_headers or {})

Type guard

def has_no_auth_header(headers: dict) -> bool:
    return "Authorization" not in {k.lower() for k in headers}

Try / catch

try:
    client = OpenAI(provider=bedrock(...), default_headers=headers)
except OpenAIError as e:
    if "Authorization" in str(e):
        headers.pop("Authorization", None)
        client = OpenAI(provider=bedrock(...), default_headers=headers)
    else:
        raise

Prevention

Never set Authorization manually with provider-based auth; supply credentials via bedrock(...).
Audit shared default_headers dicts reused across providers.
Keep provider-specific auth in the provider config, not in headers.

When it happens

Trigger: Passing `default_headers={"Authorization": "Bearer ..."}` or `extra_headers={"Authorization": ...}` to a client configured with the bedrock provider.

Common situations: Copying generic OpenAI examples that set Authorization manually; migrating code that authenticated with a static key before switching to bedrock().

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/1bedda30940ef3f1. Report an issue: GitHub.