openai/openai-python · error · OpenAIError

The Bedrock endpoint region `{region}` does not match the Si

Error message

The Bedrock endpoint region `{region}` does not match the SigV4 region `{self._config.region}`.

What it means

SigV4 validation: the region parsed from the canonical endpoint hostname differs from the region in the SigV4 config (self._config.region). AWS signatures are region-scoped, so signing with the wrong region key yields 403s at AWS; the provider fails fast instead.

Source

Thrown at src/openai/providers/bedrock.py:221

        self._auth = auth

    def _validate_request(self, request: httpx2.Request) -> bytes:
        _assert_provider_owns_authorization(request)
        if not _same_origin(request.url, self._base_url):
            raise OpenAIError(
                "Refusing to sign a Bedrock request for an origin other than the configured provider URL."
            )

        canonical_endpoint = _parse_bedrock_endpoint_hostname(request.url.host)
        if canonical_endpoint is not None:
            endpoint, region = canonical_endpoint
            expected_endpoint = "runtime" if self._config.service == "bedrock" else "mantle"
            if endpoint != expected_endpoint:
                raise OpenAIError(
                    f"The Bedrock {endpoint} hostname does not match the selected `{expected_endpoint}` endpoint."
                )
            if region != self._config.region:
                raise OpenAIError(
                    f"The Bedrock endpoint region `{region}` does not match the SigV4 region `{self._config.region}`."
                )

        return _body_for_signing(request)

    def _sign(self, request: httpx2.Request, *, auth: BedrockAwsAuth, body: bytes) -> None:
        for header in _AWS_SIGNING_HEADERS:
            request.headers.pop(header, None)

        signed_headers = auth.sign(
            method=request.method,
            url=str(request.url),
            headers=dict(request.headers),
            body=body,
        )
        request.headers.clear()
        request.headers.update(signed_headers)

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Make the configured region match the hostname region.
2. Or drop the custom base_url and let the provider build the default hostname for your region.

Example fix

# before
provider = bedrock(region="us-east-1", base_url="https://bedrock-runtime.eu-west-1.amazonaws.com")

# after
provider = bedrock(region="eu-west-1", base_url="https://bedrock-runtime.eu-west-1.amazonaws.com")

import re
m = re.search(r"\.([a-z0-9-]+)\.amazonaws\.com$", URL(base_url).host or "")
if m and m.group(1) != region:
    raise ValueError(f"base_url region {m.group(1)} != configured {region}")

def sigv4_region_matches(region: str, base_url: str) -> bool:
    m = re.search(r"\.([a-z0-9-]+)\.amazonaws\.com$", URL(base_url).host or "")
    return m is None or m.group(1) == region

try:
    provider = bedrock(region=region, base_url=base_url, aws_credentials=creds)
except OpenAIError as e:
    if "SigV4 region" in str(e):
        m = re.search(r"`([a-z0-9-]+)` does not match", str(e))
        provider = bedrock(region=m.group(1), base_url=base_url, aws_credentials=creds)
    else:
        raise

When it happens

Trigger: bedrock(region="us-east-1") with SigV4 credentials but a request URL host like bedrock-runtime.eu-west-1.amazonaws.com.

Common situations: Region env vars out of sync with a hardcoded base_url; copying endpoint URLs across environments; multi-region setups with stale configs.

Related errors

• The Bedrock AWS `region` is invalid. Use a standard AWS regi
• The Bedrock endpoint region `{canonical_region}` does not ma
• Bedrock SigV4 authentication requires a replayable request b
• Bedrock SigV4 authentication does not support automatic redi
• Refusing to sign a Bedrock request for an origin other than

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/4c88e9e90a11a002. Report an issue: GitHub.