openai/openai-python · error · OpenAIError

The Bedrock {endpoint} hostname does not match the selected

Error message

The Bedrock {endpoint} hostname does not match the selected `{expected_endpoint}` endpoint.

What it means

During SigV4 request validation, the hostname was recognized as a canonical Bedrock endpoint whose family (parsed from the host) differs from the endpoint the config expects: "runtime" when service == "bedrock", else "mantle". Signing for the wrong service family would produce an invalid signature, so it aborts.

Source

Thrown at src/openai/providers/bedrock.py:217

        auth: BedrockAwsAuth | None = None,
    ) -> None:
        self._config = config
        self._base_url = base_url
        self._auth = auth

    def _validate_request(self, request: httpx2.Request) -> bytes:
        _assert_provider_owns_authorization(request)
        if not _same_origin(request.url, self._base_url):
            raise OpenAIError(
                "Refusing to sign a Bedrock request for an origin other than the configured provider URL."
            )

        canonical_endpoint = _parse_bedrock_endpoint_hostname(request.url.host)
        if canonical_endpoint is not None:
            endpoint, region = canonical_endpoint
            expected_endpoint = "runtime" if self._config.service == "bedrock" else "mantle"
            if endpoint != expected_endpoint:
                raise OpenAIError(
                    f"The Bedrock {endpoint} hostname does not match the selected `{expected_endpoint}` endpoint."
                )
            if region != self._config.region:
                raise OpenAIError(
                    f"The Bedrock endpoint region `{region}` does not match the SigV4 region `{self._config.region}`."
                )

        return _body_for_signing(request)

    def _sign(self, request: httpx2.Request, *, auth: BedrockAwsAuth, body: bytes) -> None:
        for header in _AWS_SIGNING_HEADERS:
            request.headers.pop(header, None)

        signed_headers = auth.sign(
            method=request.method,
            url=str(request.url),
            headers=dict(request.headers),
            body=body,

View on GitHub (pinned to 9917c6e28e)

Solutions

Align the request hostname family with the configured service/endpoint, or change base_url to the runtime hostname.
Construct the provider without a custom base_url so the default hostname is used.

Example fix

# before
provider = bedrock(region="us-east-1", base_url="https://bedrock.us-east-1.amazonaws.com", aws_credentials=...)

# after
provider = bedrock(region="us-east-1", aws_credentials=...)  # default bedrock-runtime host

Defensive patterns

Strategy: validation

Validate before calling

import re
m = re.match(r"^(bedrock[a-z-]*)\.", URL(base_url).host or "")
if m:
    expected = "runtime"
    assert m.group(1).endswith(expected), f"hostname family {m.group(1)} incompatible"

Type guard

def hostname_family_ok(base_url: str, service: str) -> bool:
    m = re.match(r"^(bedrock[a-z-]*)\.", URL(base_url).host or "")
    expected = "runtime" if service == "bedrock" else "mantle"
    return m is None or m.group(1).endswith(expected)

Try / catch

try:
    provider = bedrock(base_url=base_url, region=region, aws_credentials=creds)
except OpenAIError as e:
    if "does not match the selected" in str(e):
        provider = bedrock(region=region, aws_credentials=creds)  # default hostname
    else:
        raise

Prevention

Let the provider construct default hostnames instead of overriding base_url.
When overriding, derive config from the hostname family.
Document which service each base_url belongs to.

When it happens

Trigger: A SigV4-configured provider (service "bedrock" expecting bedrock-runtime.*) whose request URL uses e.g. `bedrock.us-east-1.amazonaws.com` or a mantle-family host, or vice versa.

Common situations: Mixing base_urls between the Bedrock runtime and another Bedrock service family; FIPS or alternate endpoints pasted from AWS docs without matching the provider configuration.

Related errors

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/e0e43c42edf02e09. Report an issue: GitHub.