openai/openai-python · error · OpenAIError

The `api_key` argument must not be empty.

Error message

The `api_key` argument must not be empty.

What it means

The `api_key` argument was set to the empty string. An explicit empty bearer token is meaningless, so the Bedrock client rejects it rather than sending no/empty Authorization headers.

Source

Thrown at src/openai/lib/bedrock.py:143

def _legacy_provider(
    *,
    api_key: str | None,
    token_provider: BedrockTokenProvider | AsyncBedrockTokenProvider | None,
    aws_region: str | None,
    aws_profile: str | None,
    aws_access_key_id: str | None,
    aws_secret_access_key: str | None,
    aws_session_token: str | None,
    aws_credentials_provider: AwsCredentialsProvider | None,
    base_url: str | httpx2.URL | None,
    region_was_explicit: bool | None = None,
) -> tuple[_Provider, _LegacyBedrockState, str]:
    if callable(cast(object, api_key)):
        raise OpenAIError("Pass refreshable Bedrock credentials via `bedrock_token_provider`, not `api_key`.")
    if api_key == "":
        raise OpenAIError("The `api_key` argument must not be empty.")
    if api_key is not None and token_provider is not None:
        raise OpenAIError(
            "Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, "
            "static AWS credentials, profile, or credential provider."
        )

    explicit_aws_auth = _has_explicit_aws_auth(
        aws_profile=aws_profile,
        aws_access_key_id=aws_access_key_id,
        aws_secret_access_key=aws_secret_access_key,
        aws_session_token=aws_session_token,
        aws_credentials_provider=aws_credentials_provider,
    )
    if (api_key is not None or token_provider is not None) and explicit_aws_auth:
        raise OpenAIError(
            "Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, "
            "static AWS credentials, profile, or credential provider."
        )

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Use `os.environ.get('AWS_BEARER_TOKEN_BEDROCK')` (no default) so the value is None when unset
2. Pass `None` instead of `""` to let the client fall back to environment/profile auth
3. Set the actual bearer token value

Example fix

# before
client = BedrockOpenAI(api_key=os.environ.get('AWS_BEARER_TOKEN_BEDROCK', ''))
# after
client = BedrockOpenAI(api_key=os.environ.get('AWS_BEARER_TOKEN_BEDROCK'))

api_key = os.environ.get('AWS_BEARER_TOKEN_BEDROCK')
assert api_key != '', 'empty bearer token'

When it happens

Trigger: `BedrockOpenAI(api_key='')`, typically from `api_key=os.environ.get('AWS_BEARER_TOKEN_BEDROCK', '')` or a config field defaulting to `""`.

Common situations: Environment variable unset but `.get(..., '')` used instead of `.get(...)`; YAML/TOML config with an empty key field; copying templates that pre-fill `api_key: ""`.

Related errors

• Pass refreshable Bedrock credentials via `bedrock_token_prov
• The Bedrock bearer credential must not be empty.
• "Could not resolve authentication method. Expected either ap
• Could not find credentials for Bedrock. Set `AWS_BEARER_TOKE
• Bedrock authentication is ambiguous. Configure exactly one e

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/3b86ba8474329093. Report an issue: GitHub.