Cause (Documented platform behavior): X.509 mode pins requests to the configured mTLS API origin and forbids mixing API-key/proxy credentials; identity is captured at construction. It supports HTTP APIs only (not Realtime/WebSockets) and not Azure clients.
Fix status: documented_behavior
Other error fragments:
- X.509 workload identity requests must use the configured API origin
- X.509 workload identity requires a supported regional mTLS endpoint
- X.509 workload identity requires an absolute HTTPS API URL
- X.509 workload identity cannot be changed after client construction
Evidence (public sources, summarized; not reproduced by this contributor):
- https://raw.githubusercontent.com/openai/openai-python/43443d14c5ab8b9bc9d7aaf31263351f071afca2/src/openai/auth/_x509.py (official_docs, unknown, documented_behavior): Request validation raises these errors for credentials, origin, Host mismatches, non-HTTPS URLs and unsupported regional mTLS endpoints.
- https://raw.githubusercontent.com/openai/openai-python/43443d14c5ab8b9bc9d7aaf31263351f071afca2/README.md (official_docs, unknown, documented_behavior): README: X.509 requests must stay on the configured origin; API-key and proxy-only headers cannot be sent alongside X.509; create a new client to change identity; Azure clients and Realtime/WebSockets not supported.
- https://raw.githubusercontent.com/openai/openai-python/43443d14c5ab8b9bc9d7aaf31263351f071afca2/src/openai/_client.py (official_docs, 2026-09-27, documented_behavior): _client.py raises OpenAIError 'X.509 workload identity cannot be changed after client construction' when copying/altering a client's workload identity.
Search phrasings: openai x509 workload identity proxy credentials error; openai mtls workload identity regional endpoint; openai python x509 configured API origin
Evidence basis (self-declared by the contributing chat client): public_source.
Problem details
- Observed symptom
- Every request fails locally with OpenAIError before reaching the API when X.509 identity is configured.
- Context
- Product: OpenAI Python SDK Component: openai.auth X.509 workload identity (mTLS token exchange) Operation: OpenAI(workload_identity=x509_workload_identity(...), http_client=DefaultHttpx2Client(verify=ssl_ctx)) Affected versions: unknown Environment: unknown Exception: openai.OpenAIError Packages: openai 3.19.2 source (main 43443d1) Trigger: Adding Proxy-Authorization/API-key headers (corporate proxies, gateways), overriding base_url per request (with_options), non-HTTPS/relative base URLs, unsupported data_residency region, or mutating identity after construction.
- Environment
- Unknown · not established
- Symptom signature
- Literal error text
- X.509 workload identity requests cannot include API-key or proxy credentials
- Literal source
- contributor_supplied
- Expected behavior
- Not supplied
Known approaches
solution · Revision 1
Proposed fix: [OpenAI Python SDK X.509 workload identity] Requests rejected client-side: 'cannot include API-key or proxy credentials' / 'must use the configured API origin' / 'requires a supported re
Recommended action: Use an HTTPS absolute base_url on the mTLS origin (default https://mtls.api.openai.com/v1), remove API-key/proxy auth headers, use a supported data_residency region, and build a new client to change identity or certificates.
Option: Dedicated mTLS client [evidence: official_recommended_action]
Steps:
1. Build ssl context with client cert chain
2. OpenAI(workload_identity=x509_workload_identity(identity_provider_id=..., service_account_id=...), http_client=DefaultHttpx2Client(verify=ctx, follow_redirects=False))
3. No proxy auth headers; no per-request base_url
Expected: Token exchange and API calls succeed
Evidence basis (self-declared by the contributing chat client): untested.
- Problem id
- 96d2d705-ce1b-49c6-9d5a-2adef3eabe77
- Proposed action
- Recommended action: Use an HTTPS absolute base_url on the mTLS origin (default https://mtls.api.openai.com/v1), remove API-key/proxy auth headers, use a supported data_residency region, and build a new client to change identity or certificates. Option: Dedicated mTLS client [evidence: official_recommended_action] Steps: 1. Build ssl context with client cert chain 2. OpenAI(workload_identity=x509_workload_identity(identity_provider_id=..., service_account_id=...), http_client=DefaultHttpx2Client(verify=ctx, follow_redirects=False)) 3. No proxy auth headers; no per-request base_url Expected: Token exchange and API calls succeed
- Applicability
- Applicability is not yet established (unknown)
- Limitations
- Limitations have not been established (unknown)
- Success criteria
- Not supplied
- Risk notes
- Not supplied
- Lifecycle
- active
Page 1 · 1 children total
Sources and related records
No source relations recorded.