remotion-dev/remotion · error · RemotionInvalidArgumentException

'secret_key' must be provided when 'access_key' is specified

Error message

'secret_key' must be provided when 'access_key' is specified

What it means

Raised (with a deprecation warning) when the caller provides access_key but no secret_key to the Python RemotionClient. AWS access keys are always paired with secret keys, so passing only one is treated as a configuration mistake rather than forwarded to boto3.

Source

Thrown at packages/lambda-python/remotion_lambda/remotionclient.py:192

        # Check for conflicting authentication methods
        if session and (access_key or secret_key):
            raise RemotionInvalidArgumentException(
                "Cannot specify both 'session' and explicit credentials "
                "('access_key'/'secret_key'). Please use only 'session'."
            )

        # Handle deprecated credential parameters
        if access_key is not None or secret_key is not None:
            warnings.warn(
                "Parameters 'access_key' and 'secret_key' are deprecated "
                "as of version 4.0.376 and will be removed in version 5.0.0. "
                "Please migrate to using 'session' for improved security. ",
                DeprecationWarning,
                stacklevel=2,
            )
            # Validate both keys are provided together
            if access_key and not secret_key:
                raise RemotionInvalidArgumentException("'secret_key' must be provided when 'access_key' is specified")
            if secret_key and not access_key:
                raise RemotionInvalidArgumentException("'access_key' must be provided when 'secret_key' is specified")

            # Create session from deprecated credentials
            self.session = Session(
                aws_access_key_id=access_key,
                aws_secret_access_key=secret_key,
                region_name=region,
            )
        elif session:
            # Use provided session
            self.session = session
        else:
            # Create default session (uses credential chain)
            self.session = Session(region_name=region)

        # Store configuration
        self.region = region.strip()

View on GitHub (pinned to 78fe4bb3fd)

Solutions

1. Provide BOTH access_key and secret_key together, or migrate to the session= argument (preferred).
2. Verify env vars are set: assert os.environ.get('AWS_SECRET_ACCESS_KEY'), 'missing secret'.
3. Use a boto3 Session from an AWS profile to avoid handling raw credentials at all.

Example fix

// before
client = RemotionClient(
    region=region,
    serve_url=serve_url,
    function_name=fn,
    access_key=os.environ['AWS_ACCESS_KEY_ID'],
)

# after - preferred
session = boto3.Session(profile_name='remotion')
client = RemotionClient(
    region=region,
    serve_url=serve_url,
    function_name=fn,
    session=session,
)

def validate_paired_credentials(access_key, secret_key):
    if access_key and not secret_key:
        raise ValueError('access_key provided without secret_key')
    return True

def credentials_are_paired(access_key, secret_key) -> bool:\n    return bool(access_key) == bool(secret_key)

try:\n    client = RemotionClient(region=region, serve_url=serve_url, function_name=fn,\n                           access_key=ak, secret_key=sk)\nexcept RemotionInvalidArgumentException as e:\n    raise SystemExit(f'Credentials incomplete: {e}')

When it happens

Trigger: Calling RemotionClient(access_key='AKIA...', secret_key=None) or omitting secret_key while setting access_key. The check is `if access_key and not secret_key`.

Common situations: Reading AWS_ACCESS_KEY_ID from env but the AWS_SECRET_ACCESS_KEY variable is unset; copy-pasting only one half of a credential pair; secret_key mistakenly passed as a different kwarg name; using a profile via session while also leaking a stale access_key.

Related errors

• 'access_key' must be provided when 'secret_key' is specified
• Cannot specify both 'session' and explicit credentials ('acc
• type of startFrom prop must be a number, instead got type ${
• startFrom prop can not be NaN or Infinity.
• startFrom must be greater than equal to 0 instead got ${star

AI-assisted analysis of remotion-dev/remotion@78fe4bb3fd (2026-08-12). Data as JSON: /api/errors/96bdc4f63e7ff263. Report an issue: GitHub.