openai/openai-python · error · OpenAIError

BedrockOpenAI only supports Bedrock bearer token or AWS cred

Error message

BedrockOpenAI only supports Bedrock bearer token or AWS credential authentication.

What it means

The sync Bedrock client's `copy()` rejects `admin_api_key` and `workload_identity`. BedrockOpenAI authenticates only via Bedrock bearer tokens or AWS credentials, so OpenAI-platform admin/workload-identity options are unsupported.

Source

Thrown at src/openai/lib/bedrock.py:573

        timeout: float | Timeout | None | NotGiven = NOT_GIVEN,
        http_client: httpx2.Client | None = None,
        max_retries: int | NotGiven = NOT_GIVEN,
        default_headers: Mapping[str, str] | None = None,
        set_default_headers: Mapping[str, str] | None = None,
        default_query: Mapping[str, object] | None = None,
        set_default_query: Mapping[str, object] | None = None,
        _enforce_credentials: bool | None = None,
        _extra_kwargs: Mapping[str, Any] = {},
    ) -> Self:
        if data_residency is not None:
            raise OpenAIError("`data_residency` is only supported by OpenAI clients")
        base_url = None if isinstance(base_url, NotGiven) else base_url
        if callable(api_key):
            raise OpenAIError("Pass refreshable Bedrock credentials via `bedrock_token_provider`, not `api_key`.")
        if not isinstance(provider, NotGiven):
            raise OpenAIError("Configure `provider` on `OpenAI`, not on `BedrockOpenAI.with_options()`.")
        if admin_api_key is not None or workload_identity is not None:
            raise OpenAIError("BedrockOpenAI only supports Bedrock bearer token or AWS credential authentication.")
        if default_headers is not None and set_default_headers is not None:
            raise ValueError("The `default_headers` and `set_default_headers` arguments are mutually exclusive")
        if default_query is not None and set_default_query is not None:
            raise ValueError("The `default_query` and `set_default_query` arguments are mutually exclusive")

        headers = self._custom_headers
        if default_headers is not None:
            headers = {**headers, **default_headers}
        elif set_default_headers is not None:
            headers = set_default_headers
        params = self._custom_query
        if default_query is not None:
            params = {**params, **default_query}
        elif set_default_query is not None:
            params = set_default_query

        provider_kwargs, inherited_provider, inherited_state = _copy_configuration(
            self,

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Remove `admin_api_key`/`workload_identity` from Bedrock client calls
2. Use an `OpenAI` client for admin/workload-identity operations
3. For Bedrock, authenticate with `api_key`, `bedrock_token_provider`, or `aws_*` credentials

Example fix

# before
admin = bedrock_client.with_options(admin_api_key=ADMIN_KEY)
# after
from openai import OpenAI
admin = OpenAI(admin_api_key=ADMIN_KEY)

for k in ('admin_api_key','workload_identity'):
    assert kwargs.get(k) is None, f'{k} unsupported on Bedrock clients'

When it happens

Trigger: `bedrock_client.with_options(admin_api_key='...')` or `with_options(workload_identity=...)` — either argument non-None.

Common situations: Shared config objects feeding both OpenAI and Bedrock clients; porting platform-admin automation code to a Bedrock deployment.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• AsyncBedrockOpenAI only supports Bedrock bearer token or AWS
• `data_residency` is only supported by OpenAI clients
• Configure `provider` on `OpenAI`, not on `BedrockOpenAI.with
• Configure `provider` on `AsyncOpenAI`, not on `AsyncBedrockO
• The `default_headers` and `set_default_headers` arguments ar

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/66b2a701e93e26a4. Report an issue: GitHub.