OpenAI Python API library

<!-- prettier-ignore -->
<img src="https://img.shields.io/pypi/v/openai.svg?label=pypi%20(stable" alt="PyPI version" class="ra0-md-img" loading="lazy" />)

The OpenAI Python library provides convenient access to the OpenAI REST API from any Python 3.10+
application. The library includes type definitions for all request params and response fields,
and offers both synchronous and asynchronous clients powered by HTTPX2.

It is generated from our OpenAPI specification.

Documentation

The REST API documentation can be found on platform.openai.com. The full API of this library can be found in api.md.

Installation

# install from PyPI
pip install openai

Usage

The full API of this library can be found in api.md.

The primary API for interacting with OpenAI models is the Responses API. You can generate text from the model with the code below.

import os
from openai import OpenAI

client = OpenAI(
    # This is the default and can be omitted
    api_key=os.environ.get("OPENAI_API_KEY"),
)

response = client.responses.create(
    model="gpt-5.5",
    instructions="You are a coding assistant that talks like a pirate.",
    input="How do I check if a Python object is an instance of a class?",
)

print(response.output_text)

The previous standard (supported indefinitely) for generating text is the Chat Completions API. You can use that API to generate text from the model with the code below.

from openai import OpenAI

client = OpenAI()

completion = client.chat.completions.create(
    model="gpt-5.5",
    messages=[
        {"role": "developer", "content": "Talk like a pirate."},
        {
            "role": "user",
            "content": "How do I check if a Python object is an instance of a class?",
        },
    ],
)

print(completion.choices[0].message.content)

While you can provide an api_key keyword argument,
we recommend using python-dotenv
to add OPENAI_API_KEY="My API Key" to your .env file
so that your API key is not stored in source control.
Get an API key here.

Workload Identity Authentication

For secure, automated environments like cloud-managed Kubernetes, Azure, and Google Cloud Platform, you can use workload identity authentication with short-lived tokens from cloud identity providers instead of long-lived API keys.

Kubernetes (service account tokens)

from openai import OpenAI
from openai.auth import k8s_service_account_token_provider

client = OpenAI(
    workload_identity={
        "identity_provider_id": "idp-123",
        "service_account_id": "sa-456",
        "provider": k8s_service_account_token_provider(
            "/var/run/secrets/kubernetes.io/serviceaccount/token"
        ),
    },
)

response = client.chat.completions.create(
    model="gpt-5.5",
    messages=[{"role": "user", "content": "Hello!"}],
)

Azure (managed identity)

from openai import OpenAI
from openai.auth import azure_managed_identity_token_provider

client = OpenAI(
    workload_identity={
        "identity_provider_id": "idp-123",
        "service_account_id": "sa-456",
        "provider": azure_managed_identity_token_provider(
            resource="https://management.azure.com/",
        ),
    },
)

Google Cloud Platform (compute engine metadata)

from openai import OpenAI
from openai.auth import gcp_id_token_provider

client = OpenAI(
    workload_identity={
        "identity_provider_id": "idp-123",
        "service_account_id": "sa-456",
        "provider": gcp_id_token_provider(audience="https://api.openai.com/v1"),
    },
)

Custom subject token provider

from openai import OpenAI


def get_custom_token() -> str:
    return "your-jwt-token"


client = OpenAI(
    workload_identity={
        "identity_provider_id": "idp-123",
        "service_account_id": "sa-456",
        "provider": {
            "token_type": "jwt",
            "get_token": get_custom_token,
        },
    }
)

You can also customize the token refresh buffer (default is 1200 seconds (20 minutes) before expiration):

from openai import OpenAI
from openai.auth import k8s_service_account_token_provider

client = OpenAI(
    workload_identity={
        "identity_provider_id": "idp-123",
        "service_account_id": "sa-456",
        "provider": k8s_service_account_token_provider("/var/token"),
        "refresh_buffer_seconds": 120.0,
    }
)

X.509 workload identity (mutual TLS)

For X.509 workload identity federation, configure the client certificate and
server trust on an HTTPX2 client, then pass only the identity-provider and
service-account IDs to the SDK:

import os
import ssl

from openai import OpenAI, DefaultHttpx2Client
from openai.auth import x509_workload_identity

tls_context = ssl.create_default_context(
    cafile=os.getenv("OPENAI_MTLS_CA_BUNDLE"),
)
tls_context.load_cert_chain(
    certfile=os.environ["OPENAI_MTLS_CERTIFICATE_CHAIN"],
    keyfile=os.environ["OPENAI_MTLS_PRIVATE_KEY"],
    password=os.getenv("OPENAI_MTLS_PRIVATE_KEY_PASSWORD"),
)

client = OpenAI(
    workload_identity=x509_workload_identity(
        identity_provider_id=os.environ["OPENAI_IDENTITY_PROVIDER_ID"],
        service_account_id=os.environ["OPENAI_SERVICE_ACCOUNT_ID"],
        # refresh_buffer_seconds=120.0,
    ),
    http_client=DefaultHttpx2Client(
        verify=tls_context,
        follow_redirects=False,
    ),
)

X.509 mode defaults to https://mtls.api.openai.com/v1 when neither base_url
nor OPENAI_BASE_URL is set. The same configured HTTP client presents its
certificate to the fixed mTLS token-exchange endpoint and to the API. Tokens
are exchanged lazily, cached, and refreshed automatically. Certificate files,
private keys, passwords, server trust, proxies, and rotation remain application
and transport concerns.

X.509 API requests require HTTPS and must stay on the configured API origin.
The effective HTTP Host authority must match that origin.
Provider API-key and proxy-only headers cannot be sent to the API alongside
X.509 authentication.
Token exchanges do not inherit API request hooks, authentication, or cookies.
Identity settings are captured when the client is constructed; create a new
client to change the identity. Azure clients do not support X.509 workload
identity.

For asynchronous requests, use AsyncOpenAI with
DefaultAsyncHttpx2Client. See the complete [sync rollout-toggle
example](examples/x509_workload_identity.py) and [async rollout-toggle
example](examples/x509_workload_identity_async.py), which select API-key or
X.509 authentication with the application-owned OPENAI_AUTH_MODE
environment variable. X.509 workload identity currently supports HTTP APIs;
Realtime and WebSockets are not included.

Vision

With an image URL:

prompt = "What is in this image?"
img_url = "https://upload.wikimedia.org/wikipedia/commons/thumb/d/d5/2023_06_08_Raccoon1.jpg/1599px-2023_06_08_Raccoon1.jpg"

response = client.responses.create(
    model="gpt-5.5",
    input=[
        {
            "role": "user",
            "content": [
                {"type": "input_text", "text": prompt},
                {"type": "input_image", "image_url": f"{img_url}"},
            ],
        }
    ],
)

With the image as a base64 encoded string:

import base64
from openai import OpenAI

client = OpenAI()

prompt = "What is in this image?"
with open("path/to/image.png", "rb") as image_file:
    b64_image = base64.b64encode(image_file.read()).decode("utf-8")

response = client.responses.create(
    model="gpt-5.5",
    input=[
        {
            "role": "user",
            "content": [
                {"type": "input_text", "text": prompt},
                {"type": "input_image", "image_url": f"data:image/png;base64,{b64_image}"},
            ],
        }
    ],
)

Async usage

Simply import AsyncOpenAI instead of OpenAI and use await with each API call:

import os
import asyncio
from openai import AsyncOpenAI

client = AsyncOpenAI(
    # This is the default and can be omitted
    api_key=os.environ.get("OPENAI_API_KEY"),
)


async def main() -> None:
    response = await client.responses.create(
        model="gpt-5.5", input="Explain disestablishmentarianism to a smart five year old."
    )
    print(response.output_text)


asyncio.run(main())

Functionality between the synchronous and asynchronous clients is otherwise identical.

With aiohttp

By default, the async client uses HTTPX2. For improved concurrency performance, you may also use aiohttp as the HTTPX2 transport.

You can enable this by installing aiohttp:

# install from PyPI
pip install openai[aiohttp]

Then you can enable it by instantiating the client with http_client=DefaultAioHttpClient():

import os
import asyncio
from openai import DefaultAioHttpClient
from openai import AsyncOpenAI


async def main() -> None:
    async with AsyncOpenAI(
        api_key=os.environ.get("OPENAI_API_KEY"),  # This is the default and can be omitted
        http_client=DefaultAioHttpClient(),
    ) as client:
        chat_completion = await client.chat.completions.create(
            messages=[
                {
                    "role": "user",
                    "content": "Say this is a test",
                }
            ],
            model="gpt-5.5",
        )


asyncio.run(main())

HTTPX2 migration

HTTPX2 is the default HTTP client. If you configure a custom HTTP client, transport, timeout, authentication handler, event hook, or request mock, see the HTTPX2 migration guide.

Streaming responses

We provide support for streaming responses using Server Side Events (SSE).

from openai import OpenAI

client = OpenAI()

stream = client.responses.create(
    model="gpt-5.5",
    input="Write a one-sentence bedtime story about a unicorn.",
    stream=True,
)

for event in stream:
    print(event)

The async client uses the exact same interface.

import asyncio
from openai import AsyncOpenAI

client = AsyncOpenAI()


async def main():
    stream = await client.responses.create(
        model="gpt-5.5",
        input="Write a one-sentence bedtime story about a unicorn.",
        stream=True,
    )

    async for event in stream:
        print(event)


asyncio.run(main())

Realtime API

The Realtime API enables you to build low-latency, multi-modal conversational experiences. It currently supports text and audio as both input and output, as well as function calling through a WebSocket connection.

Under the hood the SDK uses the <code class="ra0-md-code">websockets</code> library to manage connections.

The Realtime API works through a combination of client-sent events and server-sent events. Clients can send events to do things like update session configuration or send text and audio inputs. Server events confirm when audio responses have completed, or when a text response from the model has been received. A full event reference can be found here and a guide can be found here.

Basic text based example:

import asyncio
from openai import AsyncOpenAI

async def main():
    client = AsyncOpenAI()

    async with client.realtime.connect(model="gpt-realtime-2") as connection:
        await connection.session.update(
            session={"type": "realtime", "output_modalities": ["text"]}
        )

        await connection.conversation.item.create(
            item={
                "type": "message",
                "role": "user",
                "content": [{"type": "input_text", "text": "Say hello!"}],
            }
        )
        await connection.response.create()

        async for event in connection:
            if event.type == "response.output_text.delta":
                print(event.delta, flush=True, end="")

            elif event.type == "response.output_text.done":
                print()

            elif event.type == "response.done":
                break

asyncio.run(main())

However the real magic of the Realtime API is handling audio inputs / outputs, see this example TUI script for a fully fledged example.

Realtime error handling

Whenever an error occurs, the Realtime API will send an <code class="ra0-md-code">error</code> event and the connection will stay open and remain usable. This means you need to handle it yourself, as _no errors are raised directly_ by the SDK when an error event comes in.

client = AsyncOpenAI()

async with client.realtime.connect(model="gpt-realtime-2") as connection:
    ...
    async for event in connection:
        if event.type == 'error':
            print(event.error.type)
            print(event.error.code)
            print(event.error.event_id)
            print(event.error.message)

Using types

Nested request parameters are TypedDicts. Responses are Pydantic models which also provide helper methods for things like:

• Serializing back into JSON, model.to_json()
• Converting to a dictionary, model.to_dict()

Typed requests and responses provide autocomplete and documentation within your editor. If you would like to see type errors in VS Code to help catch bugs earlier, set python.analysis.typeCheckingMode to basic.

Pagination

List methods in the OpenAI API are paginated.

This library provides auto-paginating iterators with each list response, so you do not have to request successive pages manually:

from openai import OpenAI

client = OpenAI()

all_jobs = []
# Automatically fetches more pages as needed.
for job in client.fine_tuning.jobs.list(
    limit=20,
):
    # Do something with job here
    all_jobs.append(job)
print(all_jobs)

Or, asynchronously:

import asyncio
from openai import AsyncOpenAI

client = AsyncOpenAI()


async def main() -> None:
    all_jobs = []
    # Iterate through items across all pages, issuing requests as needed.
    async for job in client.fine_tuning.jobs.list(
        limit=20,
    ):
        all_jobs.append(job)
    print(all_jobs)


asyncio.run(main())

Alternatively, you can use the .has_next_page(), .next_page_info(), or .get_next_page() methods for more granular control working with pages:

first_page = await client.fine_tuning.jobs.list(
    limit=20,
)
if first_page.has_next_page():
    print(f"will fetch next page using these details: {first_page.next_page_info()}")
    next_page = await first_page.get_next_page()
    print(f"number of items we just fetched: {len(next_page.data)}")

# Remove `await` for non-async usage.

Or just work directly with the returned data:

first_page = await client.fine_tuning.jobs.list(
    limit=20,
)

print(f"next page cursor: {first_page.after}")  # => "next page cursor: ..."
for job in first_page.data:
    print(job.id)

# Remove `await` for non-async usage.

Nested params

Nested parameters are dictionaries, typed using TypedDict, for example:

from openai import OpenAI

client = OpenAI()

response = client.responses.create(
    input=[
        {
            "role": "user",
            "content": "How much ?",
        }
    ],
    model="gpt-5.5",
    text={"format": {"type": "json_object"}},
)

File uploads

Request parameters that correspond to file uploads can be passed as bytes, or a <code class="ra0-md-code">PathLike</code> instance or a tuple of (filename, contents, media type).

from pathlib import Path
from openai import OpenAI

client = OpenAI()

client.files.create(
    file=Path("input.jsonl"),
    purpose="fine-tune",
)

The async client uses the exact same interface. If you pass a <code class="ra0-md-code">PathLike</code> instance, the file contents will be read asynchronously automatically.

Webhook Verification

Verifying webhook signatures is _optional but encouraged_.

For more information about webhooks, see the API docs.

Parsing webhook payloads

For most use cases, you will likely want to verify the webhook and parse the payload at the same time. To achieve this, we provide the method client.webhooks.unwrap(), which parses a webhook request and verifies that it was sent by OpenAI. This method will raise an error if the signature is invalid.

Note that the body parameter must be the raw JSON string sent from the server (do not parse it first). The .unwrap() method will parse this JSON for you into an event object after verifying the webhook was sent from OpenAI.

from openai import OpenAI
from flask import Flask, request

app = Flask(__name__)
client = OpenAI()  # OPENAI_WEBHOOK_SECRET environment variable is used by default


@app.route("/webhook", methods=["POST"])
def webhook():
    request_body = request.get_data(as_text=True)

    try:
        event = client.webhooks.unwrap(request_body, request.headers)

        if event.type == "response.completed":
            print("Response completed:", event.data)
        elif event.type == "response.failed":
            print("Response failed:", event.data)
        else:
            print("Unhandled event type:", event.type)

        return "ok"
    except Exception as e:
        print("Invalid signature:", e)
        return "Invalid signature", 400


if __name__ == "__main__":
    app.run(port=8000)

Verifying webhook payloads directly

In some cases, you may want to verify the webhook separately from parsing the payload. If you prefer to handle these steps separately, we provide the method client.webhooks.verify_signature() to _only verify_ the signature of a webhook request. Like .unwrap(), this method will raise an error if the signature is invalid.

Note that the body parameter must be the raw JSON string sent from the server (do not parse it first). You will then need to parse the body after verifying the signature.

import json
from openai import OpenAI
from flask import Flask, request

app = Flask(__name__)
client = OpenAI()  # OPENAI_WEBHOOK_SECRET environment variable is used by default


@app.route("/webhook", methods=["POST"])
def webhook():
    request_body = request.get_data(as_text=True)

    try:
        client.webhooks.verify_signature(request_body, request.headers)

        # Parse the body after verification
        event = json.loads(request_body)
        print("Verified event:", event)

        return "ok"
    except Exception as e:
        print("Invalid signature:", e)
        return "Invalid signature", 400


if __name__ == "__main__":
    app.run(port=8000)

Handling errors

When the library is unable to connect to the API (for example, due to network connection problems or a timeout), a subclass of openai.APIConnectionError is raised.

When the API returns a non-success status code (that is, 4xx or 5xx
response), a subclass of openai.APIStatusError is raised, containing status_code and response properties.

All errors inherit from openai.APIError.

import openai
from openai import OpenAI

client = OpenAI()

try:
    client.fine_tuning.jobs.create(
        model="gpt-4o",
        training_file="file-abc123",
    )
except openai.APIConnectionError as e:
    print("The server could not be reached")
    print(e.__cause__)  # an underlying Exception, likely raised within HTTPX2.
except openai.RateLimitError as e:
    print("A 429 status code was received; we should back off a bit.")
except openai.APIStatusError as e:
    print("Another non-200-range status code was received")
    print(e.status_code)
    print(e.response)

Error codes are as follows:

Request IDs

> For more information on debugging requests, see these docs

All object responses in the SDK provide a _request_id property which is added from the x-request-id response header so that you can quickly log failing requests and report them back to OpenAI.

response = await client.responses.create(
    model="gpt-5.5",
    input="Say 'this is a test'.",
)
print(response._request_id)  # req_123

Note that unlike other properties that use an _ prefix, the _request_id property
_is_ public. Unless documented otherwise, _all_ other _ prefix properties,
methods and modules are _private_.

> [!IMPORTANT]
> If you need to access request IDs for failed requests you must catch the APIStatusError exception

import openai

try:
    completion = await client.chat.completions.create(
        messages=[{"role": "user", "content": "Say this is a test"}], model="gpt-5.5"
    )
except openai.APIStatusError as exc:
    print(exc.request_id)  # req_123
    raise exc

Retries

Certain errors are automatically retried 2 times by default, with a short exponential backoff.
Connection errors (for example, due to a network connectivity problem), 408 Request Timeout, 409 Conflict,
429 Rate Limit, and >=500 Internal errors are all retried by default.

You can use the max_retries option to configure or disable retry settings:

from openai import OpenAI

# Configure the default for all requests:
client = OpenAI(
    # default is 2
    max_retries=0,
)

# Or, configure per-request:
client.with_options(max_retries=5).chat.completions.create(
    messages=[
        {
            "role": "user",
            "content": "How can I get the name of the current day in JavaScript?",
        }
    ],
    model="gpt-5.5",
)

Timeouts

By default requests time out after 10 minutes. You can configure this with a timeout option,
which accepts a float or an <code class="ra0-md-code">httpx2.Timeout</code> object:

import httpx2
from openai import OpenAI

# Configure the default for all requests:
client = OpenAI(
    # 20 seconds (default is 10 minutes)
    timeout=20.0,
)

# More granular control:
client = OpenAI(
    timeout=httpx2.Timeout(60.0, read=5.0, write=10.0, connect=2.0),
)

# Override per-request:
client.with_options(timeout=5.0).chat.completions.create(
    messages=[
        {
            "role": "user",
            "content": "How can I list all files in a directory using Python?",
        }
    ],
    model="gpt-5.5",
)

On timeout, an APITimeoutError is thrown.

Note that requests that time out are retried twice by default.

Advanced

Logging

We use the standard library <code class="ra0-md-code">logging</code> module.

You can enable logging by setting the environment variable OPENAI_LOG to info.

$ export OPENAI_LOG=info

Or to debug for more verbose logging.

How to tell whether None means null or missing

In an API response, a field may be explicitly null, or missing entirely; in either case, its value is None in this library. You can differentiate the two cases with .model_fields_set:

if response.my_field is None:
  if 'my_field' not in response.model_fields_set:
    print('Got json like {}, without a "my_field" key present at all.')
  else:
    print('Got json like {"my_field": null}.')

Accessing raw response data (e.g. headers)

The "raw" Response object can be accessed by prefixing .with_raw_response. to any HTTP method call, e.g.,

from openai import OpenAI

client = OpenAI()
response = client.chat.completions.with_raw_response.create(
    messages=[{
        "role": "user",
        "content": "Say this is a test",
    }],
    model="gpt-5.5",
)
print(response.headers.get('X-My-Header'))

completion = response.parse()  # get the object that `chat.completions.create()` would have returned
print(completion)

These methods return a <code class="ra0-md-code">LegacyAPIResponse</code> object. This is a legacy class as we're changing it slightly in the next major version.

For the sync client this will mostly be the same with the exception
of content & text will be methods instead of properties. In the
async client, all methods will be async.

A migration script will be provided & the migration in general should
be smooth.

.with_streaming_response

The above interface eagerly reads the full response body when you make the request, which may not always be what you want.

To stream the response body, use .with_streaming_response instead, which requires a context manager and only reads the response body once you call .read(), .text(), .json(), .iter_bytes(), .iter_text(), .iter_lines() or .parse(). In the async client, these are async methods.

As such, .with_streaming_response methods return a different <code class="ra0-md-code">APIResponse</code> object, and the async client returns an <code class="ra0-md-code">AsyncAPIResponse</code> object.

with client.chat.completions.with_streaming_response.create(
    messages=[
        {
            "role": "user",
            "content": "Say this is a test",
        }
    ],
    model="gpt-5.5",
) as response:
    print(response.headers.get("X-My-Header"))

    for line in response.iter_lines():
        print(line)

The context manager is required so that the response will reliably be closed.

Making custom/undocumented requests

This library is typed for convenient access to the documented API.

If you need to access undocumented endpoints, params, or response properties, the library can still be used.

Undocumented endpoints

To make requests to undocumented endpoints, you can make requests using client.get, client.post, and other
http verbs. Options on the client will be respected (such as retries) when making this request.

import httpx2

response = client.post(
    "/foo",
    cast_to=httpx2.Response,
    body={"my_param": True},
)

print(response.headers.get("x-foo"))

Undocumented request params

If you want to explicitly send an extra param, you can do so with the extra_query, extra_body, and extra_headers request
options.

Undocumented response properties

To access undocumented response properties, you can access the extra fields like response.unknown_prop. You
can also get all the extra fields on the Pydantic model as a dict with
<code class="ra0-md-code">response.model_extra</code>.

Configuring the HTTP client

You can override the HTTPX2 client to customize proxies, transports, authentication, event hooks, and other advanced HTTP behavior. See the HTTPX2 migration guide when updating an existing custom client.

import httpx2
from openai import OpenAI, DefaultHttpx2Client

client = OpenAI(
    # Or use the `OPENAI_BASE_URL` env var
    base_url="http://my.test.server.example.com:8083/v1",
    http_client=DefaultHttpx2Client(
        proxy="http://my.test.proxy.example.com",
        transport=httpx2.HTTPTransport(local_address="0.0.0.0"),
    ),
)

You can also customize the client on a per-request basis by using with_options():

client.with_options(http_client=DefaultHttpx2Client(...))

Mutual TLS

Before configuring a client, review the
OpenAI Mutual TLS Beta Program
for enrollment, currently supported endpoints, and certificate requirements.

For API-key authenticated HTTP requests that require mutual TLS (mTLS), configure
a native <code class="ra0-md-code">ssl.SSLContext</code>
and pass it through the custom HTTP client:

import os
import ssl

from openai import OpenAI, DefaultHttpx2Client

# Server trust is configured independently. Without `cafile`, this uses the
# operating system's normal trusted certificate authorities.
ssl_context = ssl.create_default_context(
    cafile=os.environ.get("OPENAI_MTLS_CA_BUNDLE"),
)
ssl_context.load_cert_chain(
    # This PEM must contain the leaf certificate first, followed by every
    # intermediate certificate needed to reach the server's trust anchor.
    certfile=os.environ["OPENAI_MTLS_CERTIFICATE_CHAIN"],
    keyfile=os.environ["OPENAI_MTLS_PRIVATE_KEY"],
    password=os.environ.get("OPENAI_MTLS_PRIVATE_KEY_PASSWORD"),
)

client = OpenAI(
    api_key=os.environ["OPENAI_API_KEY"],
    # A custom HTTP client does not tell the SDK that mTLS is configured, so
    # select the mTLS endpoint explicitly. Preserve an EU or custom override.
    base_url=os.environ.get(
        "OPENAI_BASE_URL",
        "https://mtls.api.openai.com/v1",
    ),
    # A client certificate belongs to the HTTP client, not the base URL.
    # Disable redirects so it cannot follow a response to another origin.
    http_client=DefaultHttpx2Client(
        verify=ssl_context,
        follow_redirects=False,
    ),
)

The async configuration is equivalent:

import os
import ssl

from openai import AsyncOpenAI, DefaultAsyncHttpx2Client

ssl_context = ssl.create_default_context(
    cafile=os.environ.get("OPENAI_MTLS_CA_BUNDLE"),
)
ssl_context.load_cert_chain(
    certfile=os.environ["OPENAI_MTLS_CERTIFICATE_CHAIN"],
    keyfile=os.environ["OPENAI_MTLS_PRIVATE_KEY"],
    password=os.environ.get("OPENAI_MTLS_PRIVATE_KEY_PASSWORD"),
)

client = AsyncOpenAI(
    api_key=os.environ["OPENAI_API_KEY"],
    base_url=os.environ.get(
        "OPENAI_BASE_URL",
        "https://mtls.api.openai.com/v1",
    ),
    http_client=DefaultAsyncHttpx2Client(
        verify=ssl_context,
        follow_redirects=False,
    ),
)

See the complete sync HTTPX2 and
async HTTPX2 examples.

The certificate-bearing HTTP client is transport-wide. For API-key mTLS,
dedicate it to the selected API origin; X.509 workload identity also uses the
fixed OpenAI mTLS token-exchange origin. Do not reuse the client for unrelated
services or pass it through with_options() with a different base_url.
If redirects are required for API-key mTLS, add an
HTTPX2 request hook that rejects requests whose scheme, host, or port differs
from the configured mTLS origin before enabling follow_redirects.

SSLContext.load_cert_chain() raises during setup for unreadable or malformed
files and for a private key that does not match the leaf certificate. Certificate
expiry, key usage, extended key usage, SAN, and trust policy remain TLS server
decisions. OpenAI does not fetch missing intermediates through AIA, so provide a
complete, leaf-first client-chain PEM. Intermediate-chain support is currently
enabled by request. Until it is enabled for your organization, use a client leaf
certificate directly signed by the uploaded CA.

For certificate rotation, build a new SSLContext, HTTP client, and OpenAI or
AsyncOpenAI client. This creates a fresh connection pool; close the old SDK
client after its in-flight requests finish. Do not assume existing TLS
connections will renegotiate.

This recipe applies to ordinary API-key HTTP traffic. For certificate-backed
token exchange, use the X.509 workload identity configuration described above.
Realtime WebSocket mTLS is not included.

Managing HTTP resources

By default the library closes underlying HTTP connections whenever the client is garbage collected. You can manually close the client using the .close() method if desired, or with a context manager that closes when exiting.

from openai import OpenAI

with OpenAI() as client:
  # make requests here
  ...

# HTTP client is now closed

Microsoft Azure OpenAI

To use this library with Azure OpenAI, use the AzureOpenAI
class instead of the OpenAI class.

> [!IMPORTANT]
> The Azure API shape differs from the core API shape which means that the static types for responses / params
> won't always be correct.

from openai import AzureOpenAI

# gets the API Key from environment variable AZURE_OPENAI_API_KEY
client = AzureOpenAI(
    # https://learn.microsoft.com/azure/ai-services/openai/reference#rest-api-versioning
    api_version="2023-07-01-preview",
    # https://learn.microsoft.com/azure/cognitive-services/openai/how-to/create-resource?pivots=web-portal#create-a-resource
    azure_endpoint="https://example-endpoint.openai.azure.com",
)

completion = client.chat.completions.create(
    model="deployment-name",  # e.g. gpt-35-instant
    messages=[
        {
            "role": "user",
            "content": "How do I output all files in a directory using Python?",
        },
    ],
)
print(completion.to_json())

In addition to the options provided in the base OpenAI client, the following options are provided:

• azure_endpoint (or the AZURE_OPENAI_ENDPOINT environment variable)
• azure_deployment
• api_version (or the OPENAI_API_VERSION environment variable)
• azure_ad_token (or the AZURE_OPENAI_AD_TOKEN environment variable)
• azure_ad_token_provider

An example of using the client with Microsoft Entra ID (formerly known as Azure Active Directory) can be found here.

Amazon Bedrock

To use this library with Amazon Bedrock's OpenAI-compatible API, configure the standard OpenAI client with the Bedrock provider.

Install the optional Bedrock dependencies to use the standard AWS credential chain and SigV4 authentication:

pip install 'openai[bedrock]'

from openai import OpenAI
from openai.providers import bedrock

# Uses your normal AWS credentials. You can omit region when it is
# configured through AWS_REGION, AWS_DEFAULT_REGION, or your AWS profile.
client = OpenAI(
    provider=bedrock(
        region="us-west-2",
    )
)

response = client.responses.create(
    model="openai.gpt-5.4",
    input="Say hello!",
)

print(response.output_text)

The provider configures AWS authentication and the Bedrock Mantle endpoint while retaining the normal SDK resources, retries, streaming, and error handling. AWS controls which endpoints and features are supported; unsupported calls surface the provider's normal HTTP errors through the SDK.

The default AWS credential chain supports environment credentials, shared credentials and config files, named profiles, SSO and assume-role profiles, and workload credentials such as ECS, EKS, and EC2 metadata. To select a named profile:

client = OpenAI(
    provider=bedrock(
        profile="my-profile",
    )
)

You can also pass access_key_id and secret_access_key, with an optional session_token, or a refreshable credential_provider that returns botocore-compatible credentials. Explicit bearer and AWS credential options are mutually exclusive.

Pass base_url to bedrock(...) or set AWS_BEDROCK_BASE_URL to override the derived https://bedrock-mantle.<region>.api.aws/openai/v1 endpoint. Custom URLs retain Mantle signing by default; pass endpoint="runtime" to use Runtime signing.

SigV4 requests require replayable, fully serialized request bodies. Standard JSON requests already meet this requirement, and response streaming is unaffected. Low-level one-shot request streams must be buffered before sending, or sent with bearer authentication and retries disabled.

Bearer tokens remain available as a compatibility or manual authentication mode. Set AWS_BEARER_TOKEN_BEDROCK to an Amazon Bedrock API key, pass api_key, or provide a refresh callback:

client = OpenAI(
    provider=bedrock(
        region="us-west-2",
        token_provider=lambda: refresh_bedrock_token(),
    )
)

Without explicit authentication, AWS_BEARER_TOKEN_BEDROCK takes precedence over the default AWS credential chain for backwards compatibility.

Legacy BedrockOpenAI client

BedrockOpenAI and AsyncBedrockOpenAI remain available for existing applications and delegate to the same provider implementation. New applications should prefer OpenAI(provider=bedrock(...)).

from openai import BedrockOpenAI

client = BedrockOpenAI(
    aws_region="us-west-2",
    aws_profile="my-profile",
)

The legacy module client also continues to support openai.api_type = "amazon-bedrock" or OPENAI_API_TYPE=amazon-bedrock.

Versioning

This package generally follows SemVer conventions, though certain backwards-incompatible changes may be released as minor versions:

1. Changes that only affect static types, without breaking runtime behavior.
2. Changes to library internals which are technically public but not intended or documented for external use. _(Please open a GitHub issue to let us know if you are relying on such internals.)_
3. Changes that we do not expect to impact the vast majority of users in practice.

Minimum supported Python version increases are released as minor versions, not patches, when package metadata can keep users on the final compatible SDK release. See the Python version support policy for the support window, release treatment, and compatibility history.

We take backwards-compatibility seriously and work hard to ensure you can rely on a smooth upgrade experience.

We are keen for your feedback; please open an issue with questions, bugs, or suggestions.

Determining the installed version

If you've upgraded to the latest version but aren't seeing any new features you were expecting then your python environment is likely still using an older version.

You can determine the version that is being used at runtime with:

import openai
print(openai.__version__)

Requirements

Python 3.10 or higher.

Contributing

See the contributing documentation.