openai/openai-python · error · OpenAIError

The `api_key` and `token_provider` options are mutually excl

Error message

The `api_key` and `token_provider` options are mutually exclusive. Configure only one.

What it means

`api_key` (bearer auth) and `token_provider` (programmatic bearer tokens) both configure Bedrock bearer authentication, so passing both is ambiguous and rejected. Configure exactly one bearer mechanism.

Source

Thrown at src/openai/providers/bedrock.py:444

    normalized_profile = _normalize_optional_string(profile)
    if profile is not None and normalized_profile is None:
        raise OpenAIError("The Bedrock AWS `profile` must not be empty.")

    if (access_key_id is None) != (secret_access_key is None) or (session_token is not None and access_key_id is None):
        raise OpenAIError(
            "Static AWS credentials require both `access_key_id` and `secret_access_key`. "
            "A `session_token` may only be used with both."
        )
    if access_key_id is not None and (not access_key_id.strip() or not cast(str, secret_access_key).strip()):
        raise OpenAIError("Static AWS credentials require non-empty `access_key_id` and `secret_access_key` values.")
    if session_token is not None and not session_token.strip():
        raise OpenAIError("A static AWS `session_token` must not be empty when provided.")

    explicit_api_key = not isinstance(api_key, NotGiven) and api_key is not None
    if explicit_api_key and (not isinstance(api_key, str) or not api_key.strip()):
        raise OpenAIError("The Bedrock bearer credential must not be empty.")
    if explicit_api_key and token_provider is not None:
        raise OpenAIError("The `api_key` and `token_provider` options are mutually exclusive. Configure only one.")

    explicit_bearer = explicit_api_key or token_provider is not None
    aws_modes = sum(
        (
            access_key_id is not None,
            normalized_profile is not None,
            credential_provider is not None,
        )
    )
    if aws_modes > 1:
        raise OpenAIError(
            "Bedrock authentication is ambiguous. Configure exactly one explicit AWS mode: static credentials, "
            "profile, or credential provider."
        )
    if explicit_bearer and aws_modes:
        raise OpenAIError(
            "Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, "
            "static AWS credentials, profile, or credential provider."

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Remove api_key when using token_provider (or set api_key=None to explicitly disable env fallback)
2. If you only need a static token, drop token_provider

Example fix

# before
bedrock(api_key=os.environ.get('OPENAI_API_KEY'), token_provider=provider)
# after
bedrock(api_key=None, token_provider=provider)

if api_key and token_provider is not None:
    raise ValueError('choose api_key or token_provider, not both')

def single_bearer_mode(api_key: object, token_provider: object) -> bool:
    return not (api_key and token_provider is not None)

When it happens

Trigger: bedrock(api_key='...', token_provider=my_provider) — e.g. wrapping OpenAIAuth with a static key left over in config while also wiring a token provider.

Common situations: Migrating from static keys to a token provider and forgetting to remove the old key, or a shared config helper that always sets api_key.

Related errors

• Bedrock authentication is ambiguous. Configure exactly one e
• Invalid `workload_identity` configuration: expected an X.509
• "Could not resolve authentication method. Expected either ap
• The `api_key` argument must not be empty.
• The `default_headers` and `set_default_headers` arguments ar

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/9fb3a7a0e2bd1042. Report an issue: GitHub.