openai/openai-python · error · OpenAIError

Failed to resolve a bearer credential for Bedrock.

Error message

Failed to resolve a bearer credential for Bedrock.

What it means

The synchronous bearer token provider (a callable you passed or the env-token function) raised an unexpected exception while resolving the credential. The provider wraps it in OpenAIError with the original as __cause__, so the underlying failure (bad creds file, expired session, etc.) is preserved.

Source

Thrown at src/openai/providers/bedrock.py:159

class _BedrockBearerAuth:
    def __init__(self, token_provider: BedrockTokenProvider, *, base_url: httpx2.URL) -> None:
        self._token_provider = token_provider
        self._base_url = base_url

    def _validate_request(self, request: httpx2.Request) -> None:
        _assert_provider_owns_authorization(request)
        if not _same_origin(request.url, self._base_url):
            raise OpenAIError(
                "Refusing to authenticate a Bedrock request for an origin other than the configured provider URL."
            )

    def _resolve_token(self) -> str:
        try:
            token = cast(object, self._token_provider())
        except OpenAIError:
            raise
        except Exception as exc:
            raise OpenAIError("Failed to resolve a bearer credential for Bedrock.") from exc

        if inspect.isawaitable(token):
            close = getattr(token, "close", None)
            if callable(close):
                close()
            raise OpenAIError("An async Bedrock token provider requires `AsyncOpenAI`.")
        if not isinstance(token, str) or not token.strip():
            raise OpenAIError("The Bedrock bearer credential provider must return a non-empty string.")
        return token

    async def _resolve_token_async(self) -> str:
        try:
            token = cast(object, self._token_provider())
            if inspect.isawaitable(token):
                token = await token
        except OpenAIError:
            raise
        except Exception as exc:

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Inspect `exc.__cause__` to find the real failure and fix that (re-auth SSO, repair credentials).
2. Wrap your own token provider so it raises OpenAIError with a clear message if you want it surfaced directly.
3. Ensure environment (AWS_PROFILE, shared credentials) is set correctly where the process runs.

Example fix

# before
def token():
    return get_secret_from_vault()  # raises VaultError

# after
def token():
    try:
        return get_secret_from_vault()
    except VaultError as e:
        raise OpenAIError("vault token fetch failed") from e

try:
    client = OpenAI(provider=bedrock(bearer=token_fn))
except OpenAIError as e:
    cause = e.__cause__
    if isinstance(cause, (TokenExpiredError, CredentialError)):
        refresh_credentials(); client = OpenAI(provider=bedrock(bearer=token_fn))
    else:
        raise

When it happens

Trigger: A custom bearer callable raising anything other than OpenAIError during client.prepare_request, e.g. a botocore session failing to load SSO tokens.

Common situations: AWS SSO token expired; ~/.aws/credential cache unreadable; a custom token fetcher hitting a network error inside its callable.

Related errors

• Could not find credentials for Bedrock. Set `AWS_BEARER_TOKE
• Refusing to authenticate a Bedrock request for an origin oth
• An async Bedrock token provider requires `AsyncOpenAI`.
• The Bedrock bearer credential provider must return a non-emp
• Could not find credentials for Bedrock. Pass a bearer creden

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/d2361e380c2d0b5d. Report an issue: GitHub.