openai/openai-python · error · OpenAIError

The `api_key` and `workload_identity` arguments are mutually

Error message

The `api_key` and `workload_identity` arguments are mutually exclusive

What it means

`OpenAI.__init__` forbids passing a real `api_key` together with `workload_identity`: X.509/subject-token identities manage their own credentials, so an explicit API key alongside them is a configuration error. The placeholder value used internally for workload identity is exempt.

Source

Thrown at src/openai/_client.py:232

                    ("workload_identity", workload_identity),
                    ("base_url", base_url),
                )
                if value is not None
            ]
            if conflicts:
                formatted = ", ".join(f"`{name}`" for name in conflicts)
                raise OpenAIError(
                    f"`provider` cannot be combined with top-level {formatted}. "
                    f"Move provider authentication and routing options into `{provider_name}(...)`."
                )

            provider_runtime = _configure_provider(provider)

        self._provider = provider
        self._provider_runtime = provider_runtime

        if api_key is not None and api_key != WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER and workload_identity is not None:
            raise OpenAIError("The `api_key` and `workload_identity` arguments are mutually exclusive")

        if is_x509_workload_identity(workload_identity):
            workload_identity = workload_identity.copy()
        self.workload_identity = workload_identity if provider_runtime is None else None

        if provider_runtime is not None:
            self.api_key = ""
            self._api_key_provider = None
            self._workload_identity_auth = None
        elif workload_identity is not None:
            self.api_key = WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER
            self._api_key_provider = None
            self._workload_identity_auth = None
        else:
            if api_key is None:
                api_key = os.environ.get("OPENAI_API_KEY")
            if callable(api_key):
                self.api_key = ""

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Remove `api_key` (rely on the workload identity for credentials)
2. Or remove `workload_identity` if you intend key-based auth
3. Unset `OPENAI_API_KEY` if it's being injected by a config layer you don't control

Example fix

# before
client = OpenAI(api_key=os.environ['OPENAI_API_KEY'], workload_identity=identity)

# after
client = OpenAI(workload_identity=identity)

if api_key and workload_identity is not None:
    raise ValueError('configure either api_key or workload_identity, not both')

try:
    client = OpenAI(api_key=api_key, workload_identity=identity)
except OpenAIError as e:
    if 'mutually exclusive' in str(e):
        client = OpenAI(workload_identity=identity)
    else:
        raise

When it happens

Trigger: `OpenAI(api_key='sk-...', workload_identity={...})`; leftover explicit api_key when enabling workload identity; config systems that inject both.

Common situations: Migrating from API-key auth to workload identity (e.g. service mesh/X.509) while env `OPENAI_API_KEY` is also passed explicitly; shared config templates supplying an api_key unconditionally.

Related errors

• Invalid `workload_identity` configuration: expected an X.509
• `provider` cannot be combined with top-level {formatted}. Mo
• Missing credentials. Please pass an `api_key`, `workload_ide
• X.509 workload identity cannot be changed after client const
• "Could not resolve authentication method. Expected either ap

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/5d5f052bf2091336. Report an issue: GitHub.