openai/openai-python · error · OpenAIError

The Bedrock bearer credential must not be empty.

Error message

The Bedrock bearer credential must not be empty.

What it means

While (re)building the internal provider for a legacy-mode Bedrock client, the stored bearer credential was missing or empty. This indicates corrupted internal state — the client was constructed in bearer mode but the credential no longer validates.

Source

Thrown at src/openai/lib/bedrock.py:346

    )
    return _LegacyRuntimeSignature(
        mode=mode,
        base_url=str(client.base_url),
        region=client.aws_region,
        credential_identity=credential_identity,
    )


def _provider_for_legacy_client(
    client: BedrockOpenAI | AsyncBedrockOpenAI,
    configuration: _LegacyAuthConfiguration,
) -> _Provider:
    mode, credential = configuration
    state = client._bedrock_state
    bearer_region = client.aws_region if state.region_was_explicit else None
    if mode == "bearer":
        if not isinstance(credential, str) or not credential:
            raise OpenAIError("The Bedrock bearer credential must not be empty.")
        return bedrock(
            endpoint=_legacy_endpoint(client.base_url),
            region=bearer_region,
            base_url=client.base_url,
            api_key=credential,
        )
    if mode == "token_provider":
        return bedrock(
            endpoint=_legacy_endpoint(client.base_url),
            region=bearer_region,
            base_url=client.base_url,
            token_provider=cast("AsyncBedrockTokenProvider", credential),
        )

    return bedrock(
        endpoint=_legacy_endpoint(client.base_url),
        region=client.aws_region,
        base_url=client.base_url,

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Reconstruct the `BedrockOpenAI` client with a valid non-empty bearer token or token provider
2. If it reproduces with normal usage, report it as an SDK bug with a minimal reproducer

try:
    resp = client.chat.completions.create(...)
except OpenAIError as e:
    if 'bearer credential must not be empty' in str(e):
        client = BedrockOpenAI(api_key=fresh_token)  # rebuild client
    else:
        raise

When it happens

Trigger: Triggered internally by `_provider_for_legacy_client` during `_refresh_legacy_provider_runtime` (e.g. in `_prepare_options` before each request) when the client's saved bearer-mode credential is not a non-empty string — for example after state refresh logic cleared it.

Common situations: Custom code mutating client internals or stale state after auth reconfiguration; typically only reachable via unusual subclassing or a bug — not normal user input.

Related errors

• Could not find credentials for Bedrock. Set `AWS_BEARER_TOKE
• Pass refreshable Bedrock credentials via `bedrock_token_prov
• The `api_key` argument must not be empty.
• Bedrock authentication is ambiguous. Configure exactly one e
• Expected `bedrock_token_provider` argument to return a non-e

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/04d67ba2dcd6fd58. Report an issue: GitHub.