[codex] Add Amazon Bedrock Responses support by jim-openai · Pull Request #3326 · openai/openai-python

jim-openai · 2026-05-27T21:59:37Z

Summary

add first-class BedrockOpenAI / AsyncBedrockOpenAI provider clients
support Bedrock base URL, region, static bearer token, and refreshable token-provider config
support Python module config via openai.api_type = "amazon-bedrock" / OPENAI_API_TYPE=amazon-bedrock
keep Bedrock support thin: SDK adapts auth and base URL, while AWS owns endpoint and feature validation
add focused tests, docs, and an example

Review Notes

This rewrite removes the earlier SDK-side endpoint/tool/include/websocket guards. Formerly guarded calls now send requests and surface normal AWS HTTP errors through the standard SDK error pipeline.
Bedrock does not implicitly reuse OPENAI_API_KEY; it reads AWS_BEARER_TOKEN_BEDROCK unless the caller passes api_key or bedrock_token_provider.
Generated admin-security routes reuse the Bedrock bearer token so they pass through to AWS instead of failing SDK auth resolution before the request.
workload_identity stays out of the Bedrock constructors. copy / with_options retain the base copy auth keywords for override typing and reject non-Bedrock auth if passed.
Kept regional Mantle endpoint derivation for now; no global endpoint behavior is added before AWS defines it.
Deliberately deferred a separate Bedrock auth/config struct. Inline config keeps this PR small and self-contained; a dedicated struct may age better if AWS adds more auth or endpoint modes.

Testing

focused Python Bedrock/module tests: 46 passed
Ruff format/check on touched Python files
Pyright on src/openai/lib/bedrock.py: 0 errors
live us-east-2 probes with refreshed Bedrock credentials:
- earlier same-day openai.gpt-5.5 pass completed static bearer-token SSE and two token-provider responses.create calls
- current recheck confirmed /v1/models returns 200 and lists openai.gpt-5.4 / openai.gpt-5.5
- current direct /openai/v1/responses and SDK responses.create probes return Bedrock 500 internal_server_error for both openai.gpt-5.4 and openai.gpt-5.5; SDKs surface normal InternalServerError with request ids, so no SDK workaround was added
- responses.connect() still passes through and AWS rejects the websocket handshake with HTTP 405

jim-openai · 2026-05-27T22:16:55Z

@trevorcreech CC for the "early parity/error" detection

apcha-oai

Main note is we should consider whether we want errors in the client or not. Philosophically putting these on the client will force users to update later as we cut releases which is slightly not ideal imo.

If AWS is going to 400/404 in these cases think it is better to rely on the server-side (similar to azure) so users can seamlessly get those updates without being forced to update their openai lib as AWS makes updates.

apcha-oai · 2026-05-28T19:56:35Z

+from .._base_client import DEFAULT_MAX_RETRIES
+from ..resources.responses.responses import Responses, AsyncResponses
+
+BedrockTokenProvider = Callable[[], str]


Consider: this is copying azure but may not evolve well to future configurations. See another example like https://github.com/openai/openai-python/blob/main/src/openai/auth/_workload.py#L29-L40

peaceful with this for now though may be better to model within a separate struct and pass that in as config for future config updates

IIUC this would require a small change in core. If you're cool with this for now, i'll try to keep change limited to bedrock support, but very open to a follow up change.

Yeah peaceful with following azure for now

apcha-oai · 2026-05-28T20:06:09Z

+        region = aws_region or os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")
+        if region is None or not region.strip():
+            raise OpenAIError(
+                "Must provide one of the `base_url` or `aws_region` arguments, or set the "


This seems a little strict but not sure what AWS's expectations are here, consider defaults

Right now bedrock/mantle only supports regional endpoints. Global is shipping within O(weeks), but I don't know the exact implementation yet.

So I think we need to keep this for now.

Ack we can loosen later to optional

jim-openai · 2026-05-29T03:08:59Z

Pushed new version

apcha-oai

Looks good! Only small note is think you will need to readd the workload_identity on copy to keep types happy but other than that looks fine

apcha-oai · 2026-05-29T14:50:19Z

+        region = aws_region or os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")
+        if region is None or not region.strip():
+            raise OpenAIError(
+                "Must provide one of the `base_url` or `aws_region` arguments, or set the "


Ack we can loosen later to optional

jim-openai · 2026-05-29T15:56:30Z

Updated after follow-up: addressed the copy / with_options typing note by retaining the base copy auth keywords and rejecting non-Bedrock auth if passed; reran focused tests, Ruff, and Pyright. Apologies that I could not complete the planned fresh manual Responses recheck: Bedrock /openai/v1/responses was returning provider-side 500 internal_server_error for both openai.gpt-5.4 and openai.gpt-5.5, reproduced with direct curl and confirmed by others, so I did not add an SDK workaround. The PR body has the current manual probe details.

jim-openai requested a review from apcha-oai May 27, 2026 21:59

apcha-oai reviewed May 28, 2026

View reviewed changes

Comment thread src/openai/lib/bedrock.py Outdated

jim-openai force-pushed the codex/bedrock-responses-review branch from 780bd12 to afca5f7 Compare May 28, 2026 23:56

apcha-oai changed the base branch from main to next May 29, 2026 14:52

apcha-oai previously approved these changes May 29, 2026

View reviewed changes

[codex] Add Amazon Bedrock provider support

8be32d3

jim-openai dismissed apcha-oai’s stale review via 8be32d3 May 29, 2026 15:43

jim-openai force-pushed the codex/bedrock-responses-review branch from afca5f7 to 8be32d3 Compare May 29, 2026 15:43

Conversation

jim-openai commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Review Notes

Testing

Uh oh!

jim-openai commented May 27, 2026

Uh oh!

apcha-oai left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

apcha-oai May 28, 2026

Choose a reason for hiding this comment

Uh oh!

jim-openai May 29, 2026

Choose a reason for hiding this comment

Uh oh!

apcha-oai May 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

apcha-oai May 28, 2026

Choose a reason for hiding this comment

Uh oh!

jim-openai May 28, 2026

Choose a reason for hiding this comment

Uh oh!

apcha-oai May 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jim-openai commented May 29, 2026

Uh oh!

apcha-oai left a comment

Choose a reason for hiding this comment

Uh oh!

apcha-oai May 29, 2026

Choose a reason for hiding this comment

Uh oh!

jim-openai commented May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jim-openai commented May 27, 2026 •

edited

Loading

apcha-oai left a comment •

edited

Loading