openai/openai-python · error · OpenAIError

Could not find credentials for Bedrock. Pass a bearer creden

Error message

Could not find credentials for Bedrock. Pass a bearer credential or AWS credentials to `bedrock(...)`, set `AWS_BEARER_TOKEN_BEDROCK`, or configure the default AWS credential chain.

What it means

When no explicit bearer or AWS credentials are supplied, configure() falls back to AWS_BEARER_TOKEN_BEDROCK; if that env var is unset or empty, the environment_token closure raises this OpenAIError at client construction. The message lists every accepted way to provide Bedrock credentials.

Source

Thrown at src/openai/providers/bedrock.py:325

                None,
            )

        auth = BedrockAwsAuth.resolve(
            region=None,
            profile=self.profile,
            access_key_id=self.access_key_id,
            secret_access_key=self.secret_access_key,
            session_token=self.session_token,
            credentials_provider=self.credential_provider,
            service="bedrock" if self.endpoint == "runtime" else "bedrock-mantle",
        )
        return auth.config, auth

    def configure(self) -> _ProviderRuntime:
        def environment_token() -> str:
            token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")
            if not token:
                raise OpenAIError(
                    "Could not find credentials for Bedrock. Pass a bearer credential or AWS credentials to "
                    "`bedrock(...)`, set `AWS_BEARER_TOKEN_BEDROCK`, or configure the default AWS credential chain."
                )
            return token

        auth: _BedrockBearerAuth | _BedrockSigV4Auth | None = None
        bearer_provider: BedrockTokenProvider | None = None
        if self.api_key is not None:
            bearer_provider = lambda: self.api_key or ""
            region = self.configured_region
        elif self.token_provider is not None:
            bearer_provider = self.token_provider
            region = self.configured_region
        elif self.use_environment_bearer:
            bearer_provider = environment_token
            region = self.configured_region
        else:
            aws_config, aws_auth = self._resolve_aws_auth()

View on GitHub (pinned to 9917c6e28e)

Solutions

Pass a bearer token or AWS credentials to bedrock(...).
Export AWS_BEARER_TOKEN_BEDROCK (or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/region) in the environment where the process runs.
Verify with `aws sts get-caller-identity` that the default chain resolves in that shell/container.

Example fix

# before
client = OpenAI(provider=bedrock(region="us-east-1"))

# after
client = OpenAI(provider=bedrock(region="us-east-1", aws_credentials=creds))
# or: export AWS_BEARER_TOKEN_BEDROCK=...

Defensive patterns

Strategy: validation

Validate before calling

import os
has_bearer = bool(os.environ.get("AWS_BEARER_TOKEN_BEDROCK", "").strip())
has_chain = bool(os.environ.get("AWS_ACCESS_KEY_ID") and os.environ.get("AWS_SECRET_ACCESS_KEY"))
assert has_bearer or has_chain or explicit_credentials, "no Bedrock credentials configured"

Type guard

def has_bedrock_credentials(bearer_arg=None, creds_arg=None) -> bool:
    import os
    return any([bearer_arg, creds_arg, os.environ.get("AWS_BEARER_TOKEN_BEDROCK", "").strip(), os.environ.get("AWS_ACCESS_KEY_ID")])

Try / catch

try:
    client = OpenAI(provider=bedrock(region=region))
except OpenAIError as e:
    if "Could not find credentials" in str(e):
        raise RuntimeError("configure AWS_BEARER_TOKEN_BEDROCK or pass credentials") from e
    raise

Prevention

Set AWS_BEARER_TOKEN_BEDROCK in deployment environments or pass credentials explicitly.
Add a startup credential check before serving traffic.
Verify with `aws sts get-caller-identity` in the same shell/container.

When it happens

Trigger: Instantiating OpenAI(provider=bedrock(...)) with no bearer/credentials arguments while AWS_BEARER_TOKEN_BEDROCK, and no default AWS credential chain usable for SigV4, are available; the token provider is then invoked and raises.

Common situations: Local dev without AWS env configured; CI containers lacking ~/.aws and env vars; typos in the env var name; forgotten aws_credentials parameter.

Related errors

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/0765f725e0fbf7a5. Report an issue: GitHub.