openai/openai-python · error · ValueError

Expected `bedrock_token_provider` argument to return a non-e

Error message

Expected `bedrock_token_provider` argument to return a non-empty string.

What it means

The sync client's `_refresh_api_key` calls the user-supplied `bedrock_token_provider` and requires it to return a non-empty string. A provider returning `None`, an empty string, or a non-string value fails this check before the request is sent.

Source

Thrown at src/openai/lib/bedrock.py:525

        return ("aws", None)

    def _uses_aws_auth(self) -> bool:
        return (
            self._bedrock_state.explicit_api_key is None
            and not self.api_key
            and self._bedrock_token_provider is None
            and not self._bedrock_state.uses_environment_bearer
        )

    @override
    def _refresh_api_key(self) -> str:
        if self._bedrock_state.uses_environment_bearer:
            captured = self._bedrock_state.environment_bearer_token or ""
            return self.api_key if self.api_key and self.api_key != captured else captured
        if self._bedrock_token_provider is not None:
            token = cast(object, self._bedrock_token_provider())
            if not isinstance(token, str) or not token:
                raise ValueError("Expected `bedrock_token_provider` argument to return a non-empty string.")
            return token
        return self.api_key

    @override
    def _prepare_options(self, options: FinalRequestOptions) -> FinalRequestOptions:
        _refresh_legacy_provider_runtime(self)
        return super()._prepare_options(options)

    @override
    def copy(
        self,
        *,
        api_key: str | BedrockTokenProvider | None = None,
        admin_api_key: str | None = None,
        workload_identity: WorkloadIdentity | X509WorkloadIdentity | None = None,
        provider: _Provider | None | NotGiven = NOT_GIVEN,
        bedrock_token_provider: BedrockTokenProvider | None = None,
        aws_region: str | None = None,

View on GitHub (pinned to 9917c6e28e)

Solutions

Make the provider raise a clear exception on failure instead of returning None/empty
Fix the provider to always return the token string, e.g. `os.environ['AWS_BEARER_TOKEN_BEDROCK']` (raises KeyError if unset)
Add logging/retries around the token fetch inside the provider

Example fix

# before
client = BedrockOpenAI(bedrock_token_provider=lambda: os.environ.get('AWS_BEARER_TOKEN_BEDROCK'))
# after
client = BedrockOpenAI(bedrock_token_provider=lambda: os.environ['AWS_BEARER_TOKEN_BEDROCK'])

Defensive patterns

Strategy: validation

Validate before calling

def provider():
    token = fetch_token()
    if not isinstance(token, str) or not token:
        raise RuntimeError('token fetch failed')
    return token

Try / catch

try:
    resp = client.chat.completions.create(...)
except ValueError as e:
    if 'non-empty string' in str(e):
        refresh_and_retry()

Prevention

Never let a token provider return None or empty string; raise instead
Log token-refresh outcomes inside the provider

When it happens

Trigger: `BedrockOpenAI(bedrock_token_provider=lambda: None)` or a provider whose token fetch fails and returns `''`/None; raised on the first request (or token refresh) that invokes the provider.

Common situations: Token endpoint outage causing the fetch helper to return None instead of raising; providers written to return empty on failure; caching layers returning a missing key's default `""`.

Related errors

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/2fcd18783613d789. Report an issue: GitHub.