openai/openai-python · error · OpenAIError

Pass refreshable Bedrock credentials via `bedrock_token_prov

Error message

Pass refreshable Bedrock credentials via `bedrock_token_provider`, not `api_key`.

What it means

The Bedrock client's `api_key` parameter only accepts a static string bearer token. Passing a callable (the pattern used for refreshable credentials on the regular OpenAI client) is rejected because Bedrock credential refresh must go through the dedicated `bedrock_token_provider` argument.

Source

Thrown at src/openai/lib/bedrock.py:141

        )
    return token


def _legacy_provider(
    *,
    api_key: str | None,
    token_provider: BedrockTokenProvider | AsyncBedrockTokenProvider | None,
    aws_region: str | None,
    aws_profile: str | None,
    aws_access_key_id: str | None,
    aws_secret_access_key: str | None,
    aws_session_token: str | None,
    aws_credentials_provider: AwsCredentialsProvider | None,
    base_url: str | httpx2.URL | None,
    region_was_explicit: bool | None = None,
) -> tuple[_Provider, _LegacyBedrockState, str]:
    if callable(cast(object, api_key)):
        raise OpenAIError("Pass refreshable Bedrock credentials via `bedrock_token_provider`, not `api_key`.")
    if api_key == "":
        raise OpenAIError("The `api_key` argument must not be empty.")
    if api_key is not None and token_provider is not None:
        raise OpenAIError(
            "Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, "
            "static AWS credentials, profile, or credential provider."
        )

    explicit_aws_auth = _has_explicit_aws_auth(
        aws_profile=aws_profile,
        aws_access_key_id=aws_access_key_id,
        aws_secret_access_key=aws_secret_access_key,
        aws_session_token=aws_session_token,
        aws_credentials_provider=aws_credentials_provider,
    )
    if (api_key is not None or token_provider is not None) and explicit_aws_auth:
        raise OpenAIError(
            "Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, "

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Move the callable to the `bedrock_token_provider=` argument of `BedrockOpenAI`
2. If you truly have a static token, pass the string directly to `api_key`
3. For AWS SigV4-style auth, pass `aws_access_key_id`/`aws_secret_access_key`/`aws_session_token` or `aws_profile` instead

Example fix

// before
client = BedrockOpenAI(api_key=lambda: fetch_bearer_token())
// after
client = BedrockOpenAI(bedrock_token_provider=fetch_bearer_token)

def is_static_key(api_key):
    return not callable(api_key)

assert not callable(api_key), 'use bedrock_token_provider for callables'

def is_bedrock_static_key(v) -> TypeGuard[str | None]:
    return v is None or isinstance(v, str)

When it happens

Trigger: Constructing `BedrockOpenAI(api_key=lambda: os.environ['AWS_BEARER_TOKEN_BEDROCK'])` or calling `with_options(api_key=callable)` — any callable value for `api_key` on a Bedrock client (sync or async, __init__ or copy).

Common situations: Porting code from `OpenAI(api_key=callable)` to `BedrockOpenAI`; assuming the refreshable-api_key pattern is uniform across clients; wrapping expiring AWS bearer tokens in a closure out of habit.

Related errors

• Could not find credentials for Bedrock. Set `AWS_BEARER_TOKE
• The `api_key` argument must not be empty.
• Bedrock authentication is ambiguous. Configure exactly one e
• The Bedrock AWS `region` is invalid. Use a standard AWS regi
• The Bedrock {canonical_family} hostname does not match the s

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/22fd837b5eaaefe1. Report an issue: GitHub.