openai/openai-python · error · OpenAIError

Static AWS credentials require both `access_key_id` and `sec

Error message

Static AWS credentials require both `access_key_id` and `secret_access_key`. A `session_token` may only be used with both.

What it means

Static AWS credential arguments must be complete: `access_key_id` and `secret_access_key` are a pair, and `session_token` is only valid when both are present. Supplying only one of the pair, or a session token without the key pair, raises this OpenAIError.

Source

Thrown at src/openai/providers/bedrock.py:431

        configured_base_url = None
    else:
        if isinstance(base_url, str) and not base_url.strip():
            raise OpenAIError("The Bedrock `base_url` must not be empty.")
        configured_base_url = _normalize_base_url(base_url)

    canonical_endpoint = (
        _parse_bedrock_endpoint_hostname(configured_base_url.host) if configured_base_url is not None else None
    )
    resolved_endpoint: BedrockEndpoint = endpoint or (
        canonical_endpoint[0] if canonical_endpoint is not None else "mantle"
    )

    normalized_profile = _normalize_optional_string(profile)
    if profile is not None and normalized_profile is None:
        raise OpenAIError("The Bedrock AWS `profile` must not be empty.")

    if (access_key_id is None) != (secret_access_key is None) or (session_token is not None and access_key_id is None):
        raise OpenAIError(
            "Static AWS credentials require both `access_key_id` and `secret_access_key`. "
            "A `session_token` may only be used with both."
        )
    if access_key_id is not None and (not access_key_id.strip() or not cast(str, secret_access_key).strip()):
        raise OpenAIError("Static AWS credentials require non-empty `access_key_id` and `secret_access_key` values.")
    if session_token is not None and not session_token.strip():
        raise OpenAIError("A static AWS `session_token` must not be empty when provided.")

    explicit_api_key = not isinstance(api_key, NotGiven) and api_key is not None
    if explicit_api_key and (not isinstance(api_key, str) or not api_key.strip()):
        raise OpenAIError("The Bedrock bearer credential must not be empty.")
    if explicit_api_key and token_provider is not None:
        raise OpenAIError("The `api_key` and `token_provider` options are mutually exclusive. Configure only one.")

    explicit_bearer = explicit_api_key or token_provider is not None
    aws_modes = sum(
        (
            access_key_id is not None,

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Provide both access_key_id and secret_access_key together, plus session_token only if using temporary credentials
2. Drop session_token if you only have long-lived keys
3. If using a profile or token provider instead, remove the partial static keys entirely

Example fix

# before
bedrock(access_key_id=ak, session_token=st)
# after
bedrock(access_key_id=ak, secret_access_key=sk, session_token=st)

if (access_key_id is None) != (secret_access_key is None) or (session_token and not access_key_id):
    raise ValueError('incomplete static AWS credentials')

def has_complete_static_creds(ak: str | None, sk: str | None, st: str | None) -> bool:
    return (ak is None) == (sk is None) and (st is None or ak is not None)

When it happens

Trigger: bedrock(secret_access_key='...') without access_key_id; bedrock(access_key_id='...') without secret_access_key; bedrock(session_token='...') with no static keys.

Common situations: Copy-pasting only part of a credential set, or conditionally passing keys (e.g. secret set in one env but key unset in another) and forwarding both variables blindly.

Related errors

• The Bedrock AWS `profile` must not be empty.
• Static AWS credentials require non-empty `access_key_id` and
• A static AWS `session_token` must not be empty when provided
• Bedrock authentication is ambiguous. Configure exactly one e
• The `api_key` argument must not be empty.

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/b17f15795e9767ac. Report an issue: GitHub.