openai/openai-python · error · OpenAIError

The Bedrock bearer credential provider must return a non-emp

Error message

The Bedrock bearer credential provider must return a non-empty string.

What it means

After resolving a bearer credential, the provider validates it is a non-empty (non-whitespace) string. Returning None, an object, or an empty/blank string means there is no usable credential, so it refuses before sending an unauthenticated request that would just 403.

Source

Thrown at src/openai/providers/bedrock.py:167

            raise OpenAIError(
                "Refusing to authenticate a Bedrock request for an origin other than the configured provider URL."
            )

    def _resolve_token(self) -> str:
        try:
            token = cast(object, self._token_provider())
        except OpenAIError:
            raise
        except Exception as exc:
            raise OpenAIError("Failed to resolve a bearer credential for Bedrock.") from exc

        if inspect.isawaitable(token):
            close = getattr(token, "close", None)
            if callable(close):
                close()
            raise OpenAIError("An async Bedrock token provider requires `AsyncOpenAI`.")
        if not isinstance(token, str) or not token.strip():
            raise OpenAIError("The Bedrock bearer credential provider must return a non-empty string.")
        return token

    async def _resolve_token_async(self) -> str:
        try:
            token = cast(object, self._token_provider())
            if inspect.isawaitable(token):
                token = await token
        except OpenAIError:
            raise
        except Exception as exc:
            raise OpenAIError("Failed to resolve a bearer credential for Bedrock.") from exc

        if not isinstance(token, str) or not token.strip():
            raise OpenAIError("The Bedrock bearer credential provider must return a non-empty string.")
        return token

    def prepare_request(self, request: httpx2.Request) -> None:
        self._validate_request(request)

View on GitHub (pinned to 9917c6e28e)

Solutions

Fix the provider to always return a real token string or raise a clear error.
Check AWS_BEARER_TOKEN_BEDROCK is set to an actual non-blank value.
If it returns an object, extract the token field: `return tok.access_token`.

Example fix

# before
def token():
    tok = maybe_get_token()
    return tok  # None on miss

# after
def token():
    tok = maybe_get_token()
    if tok is None:
        raise OpenAIError("no token available")
    return tok

Defensive patterns

Strategy: validation

Validate before calling

token = token_provider()
assert isinstance(token, str) and token.strip(), "token provider must return a non-empty string"

Type guard

def is_valid_bearer_token(v: object) -> bool:
    return isinstance(v, str) and bool(v.strip())

Try / catch

try:
    client = OpenAI(provider=bedrock(bearer=token_fn))
except OpenAIError as e:
    if "non-empty string" in str(e):
        raise RuntimeError("token provider returned no usable token") from e
    raise

Prevention

Make token providers raise on failure instead of returning None.
Extract .token/.access_token from credential objects before returning.
Assert env vars are non-blank in CI before running the app.

When it happens

Trigger: A token provider returning None on failure, returning a dict/object token, or the environment variable AWS_BEARER_TOKEN_BEDROCK being set to whitespace; also a provider returning an empty string after stripping.

Common situations: Token provider with a bug returning None instead of raising; env var set to "" or spaces in CI; a token object that is not a plain str.

Related errors

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/c7a5310f593c404f. Report an issue: GitHub.