openai/openai-python · error · OpenAIError

Bedrock SigV4 authentication does not support automatic redi

Error message

Bedrock SigV4 authentication does not support automatic redirects. Send a new request to the redirect target so it can be signed again.

What it means

SigV4 signatures cover the method, path, headers and body for one specific URL; blindly following a redirect would resend the signed Authorization to a different origin unsigned/invalid. The provider therefore disables automatic redirects and raises if follow_redirects was requested so the caller can re-sign each hop explicitly.

Source

Thrown at src/openai/providers/bedrock.py:133

def _body_for_signing(request: httpx2.Request) -> bytes:
    try:
        return request.content
    except request_not_read_exceptions() as exc:
        raise OpenAIError(
            "Bedrock SigV4 authentication requires a replayable request body. "
            "Buffer the body before sending or use bearer authentication."
        ) from exc


def _assert_provider_owns_authorization(request: httpx2.Request) -> None:
    if "Authorization" in request.headers:
        raise OpenAIError("Bedrock provider authentication cannot be combined with a custom `Authorization` header.")


def _without_redirects(options: FinalRequestOptions) -> FinalRequestOptions:
    if options.follow_redirects:
        raise OpenAIError(
            "Bedrock SigV4 authentication does not support automatic redirects. "
            "Send a new request to the redirect target so it can be signed again."
        )
    options.follow_redirects = False
    return options


class _BedrockBearerAuth:
    def __init__(self, token_provider: BedrockTokenProvider, *, base_url: httpx2.URL) -> None:
        self._token_provider = token_provider
        self._base_url = base_url

    def _validate_request(self, request: httpx2.Request) -> None:
        _assert_provider_owns_authorization(request)
        if not _same_origin(request.url, self._base_url):
            raise OpenAIError(
                "Refusing to authenticate a Bedrock request for an origin other than the configured provider URL."
            )

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Disable follow_redirects for the Bedrock client.
2. If a redirect occurs, issue a new request to the target URL through the provider so it gets signed again.
3. Point base_url directly at the final (non-redirecting) endpoint.

Example fix

// before
client = OpenAI(provider=bedrock(...), follow_redirects=True)

// after
client = OpenAI(provider=bedrock(...), follow_redirects=False)

assert not client_options.get("follow_redirects"), "Bedrock SigV4 requires follow_redirects=False"

def is_redirect_safe(options: dict, using_sigv4: bool) -> bool:
    return not using_sigv4 or not options.get("follow_redirects")

try:
    client = OpenAI(provider=bedrock(...), follow_redirects=True)
except OpenAIError as e:
    if "redirects" in str(e):
        client = OpenAI(provider=bedrock(...), follow_redirects=False)
    else:
        raise

When it happens

Trigger: Creating the provider with follow_redirects=True (FinalRequestOptions) — e.g. client options that enable redirect following — for a Bedrock SigV4-authenticated setup.

Common situations: Global httpx2 client options with follow_redirects=True reused across providers; an endpoint behind a redirecting load balancer.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Bedrock SigV4 authentication requires a replayable request b
• Refusing to sign a Bedrock request for an origin other than
• The Bedrock {endpoint} hostname does not match the selected
• The Bedrock endpoint region `{region}` does not match the Si
• Could not find credentials for Bedrock. Set `AWS_BEARER_TOKE

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/7b508bd7462c54bd. Report an issue: GitHub.