openai/openai-python · critical · OpenAIError

Could not find credentials for Bedrock. Set `AWS_BEARER_TOKE

Error message

Could not find credentials for Bedrock. Set `AWS_BEARER_TOKEN_BEDROCK` or configure the default AWS credential chain.

What it means

The Bedrock OpenAI client falls back to the AWS_BEARER_TOKEN_BEDROCK environment variable for bearer-token auth when no explicit api_key was provided, and that variable is empty/unset, so no credential could be resolved.

Source

Thrown at src/openai/lib/bedrock.py:120

    aws_session_token: str | None,
    aws_credentials_provider: AwsCredentialsProvider | None,
) -> bool:
    return any(
        value is not None
        for value in (
            aws_profile,
            aws_access_key_id,
            aws_secret_access_key,
            aws_session_token,
            aws_credentials_provider,
        )
    )


def _environment_bearer_token() -> str:
    token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")
    if not token:
        raise OpenAIError(
            "Could not find credentials for Bedrock. Set `AWS_BEARER_TOKEN_BEDROCK` or configure the default "
            "AWS credential chain."
        )
    return token


def _legacy_provider(
    *,
    api_key: str | None,
    token_provider: BedrockTokenProvider | AsyncBedrockTokenProvider | None,
    aws_region: str | None,
    aws_profile: str | None,
    aws_access_key_id: str | None,
    aws_secret_access_key: str | None,
    aws_session_token: str | None,
    aws_credentials_provider: AwsCredentialsProvider | None,
    base_url: str | httpx2.URL | None,
    region_was_explicit: bool | None = None,

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Export AWS_BEARER_TOKEN_BEDROCK with your Bedrock bearer token
2. Or pass api_key explicitly when constructing the client
3. If using SigV4-style default AWS credentials, ensure the client is configured for that chain and a bearer token is not required

Example fix

# before
client = OpenAI(provider=Provider.bedrock)  # no bearer token anywhere
# after
# export AWS_BEARER_TOKEN_BEDROCK=...
client = OpenAI(provider=Provider.bedrock, api_key=os.environ["AWS_BEARER_TOKEN_BEDROCK"])

import os
bearer = os.environ.get("AWS_BEARER_TOKEN_BEDROCK", "").strip()
if not bearer:
    raise RuntimeError("AWS_BEARER_TOKEN_BEDROCK is required for Bedrock bearer auth")

try:
    client = OpenAI(provider=Provider.bedrock)
except OpenAIError as e:
    if "AWS_BEARER_TOKEN_BEDROCK" in str(e):
        raise ConfigError(str(e)) from e
    raise

When it happens

Trigger: Creating a Bedrock-configured client without api_key or AWS_BEARER_TOKEN_BEDROCK; the env var set but empty (e.g. `AWS_BEARER_TOKEN_BEDROCK=` in .env); called from _copy_configuration during with_options() when the original client relied on the env token.

Common situations: Missing env var in CI/containers, empty-string env entries in compose files, or relying on the default AWS credential chain where only bearer-token auth is supported for this path.

Related errors

• Could not find credentials for Bedrock. Pass a bearer creden
• Pass refreshable Bedrock credentials via `bedrock_token_prov
• Bedrock authentication is ambiguous. Configure exactly one e
• Failed to resolve a bearer credential for Bedrock.
• Bedrock requires an AWS region. Pass `region` to `bedrock(..

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/d22894ffb4ef458f. Report an issue: GitHub.