openai/openai-python · error · OpenAIError

Refusing to authenticate a Bedrock request for an origin oth

Error message

Refusing to authenticate a Bedrock request for an origin other than the configured provider URL.

What it means

The bearer-auth validator checks that the request URL shares scheme+host+port with the provider's configured base_url. Signing a different origin with your Bedrock bearer token would leak the credential outside Bedrock, so it refuses. This typically happens when a relative base_url causes request URLs to resolve against httpx2's default origin.

Source

Thrown at src/openai/providers/bedrock.py:149

def _without_redirects(options: FinalRequestOptions) -> FinalRequestOptions:
    if options.follow_redirects:
        raise OpenAIError(
            "Bedrock SigV4 authentication does not support automatic redirects. "
            "Send a new request to the redirect target so it can be signed again."
        )
    options.follow_redirects = False
    return options


class _BedrockBearerAuth:
    def __init__(self, token_provider: BedrockTokenProvider, *, base_url: httpx2.URL) -> None:
        self._token_provider = token_provider
        self._base_url = base_url

    def _validate_request(self, request: httpx2.Request) -> None:
        _assert_provider_owns_authorization(request)
        if not _same_origin(request.url, self._base_url):
            raise OpenAIError(
                "Refusing to authenticate a Bedrock request for an origin other than the configured provider URL."
            )

    def _resolve_token(self) -> str:
        try:
            token = cast(object, self._token_provider())
        except OpenAIError:
            raise
        except Exception as exc:
            raise OpenAIError("Failed to resolve a bearer credential for Bedrock.") from exc

        if inspect.isawaitable(token):
            close = getattr(token, "close", None)
            if callable(close):
                close()
            raise OpenAIError("An async Bedrock token provider requires `AsyncOpenAI`.")
        if not isinstance(token, str) or not token.strip():
            raise OpenAIError("The Bedrock bearer credential provider must return a non-empty string.")

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Pass a fully-qualified base_url including scheme and host, e.g. "https://bedrock-runtime.us-east-1.amazonaws.com".
2. Ensure nothing rewrites request URLs to a different origin after the client builds them.

Example fix

// before
provider = bedrock(region="us-east-1", base_url="/bedrock")

// after
provider = bedrock(region="us-east-1", base_url="https://bedrock-runtime.us-east-1.amazonaws.com")

from httpx2 import URL
u = URL(base_url)
assert u.scheme and u.host, "base_url must be absolute (scheme + host)"

def is_absolute_url(base_url: str) -> bool:
    u = URL(base_url)
    return bool(u.scheme and u.host)

try:
    client = OpenAI(provider=bedrock(region=region, base_url=base_url))
except OpenAIError as e:
    if "origin" in str(e):
        client = OpenAI(provider=bedrock(region=region))  # default URL
    else:
        raise

When it happens

Trigger: Configuring the Bedrock provider with a base_url lacking a host (e.g. "/bedrock") so request.url.origin != base_url.origin; or an interceptor rewriting the request to another host.

Common situations: Passing a path-only base_url (common when migrating from Azure-style `base_url="/deployment"` patterns); proxies mutating the URL; trailing-slash/host typos making origins differ.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Refusing to sign a Bedrock request for an origin other than
• Failed to resolve a bearer credential for Bedrock.
• An async Bedrock token provider requires `AsyncOpenAI`.
• The Bedrock bearer credential provider must return a non-emp
• Could not find credentials for Bedrock. Set `AWS_BEARER_TOKE

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/6156edf40eb9d7b3. Report an issue: GitHub.