openai 7.3.0 → 7.5.0

package/src/auth/subject-token-providers.ts

@@ -1,3 +1,4 @@
+import type * as FsPromises from 'node:fs/promises';
 import type { SubjectTokenProvider } from './types';
 import type { Fetch } from '../internal/builtin-types';
 import * as Shims from '../internal/shims';
@@ -7,23 +8,39 @@ const DEFAULT_RESOURCE = 'https://management.azure.com/';
 const DEFAULT_AZURE_API_VERSION = '2018-02-01';
 const AZURE_IMDS_BASE_URL = 'http://169.254.169.254/metadata/identity/oauth2/token';
 
+/** Reads the UTF-8 contents of a Kubernetes service-account token file. */
 type ReadFile = (path: string) => Promise<string>;
 
-let fsPromisesModule: Promise<typeof import('node:fs/promises')> | undefined;
+let fsPromisesModule: Promise<typeof FsPromises> | undefined;
 
 async function defaultReadFile(path: string): Promise<string> {
-  fsPromisesModule ??= import('fs/promises').catch((error) => {
+  fsPromisesModule ??= import('node:fs/promises').catch((error) => {
     fsPromisesModule = undefined;
     throw error;
   });
 
   const { readFile } = await fsPromisesModule;
-  return readFile(path, 'utf8');
+  return readFile(path, 'utf-8');
 }
 
+/**
+ * Reads a Kubernetes service-account JWT from its mounted token file.
+ *
+ * The file is read again for each token exchange so projected or rotated tokens
+ * are picked up automatically. The default reader requires Node.js filesystem
+ * access; provide `config.readFile` when using another compatible runtime.
+ *
+ * @param tokenPath Path to the token file; defaults to
+ * `/var/run/secrets/kubernetes.io/serviceaccount/token`.
+ * @param config Optional replacement for the default UTF-8 file reader.
+ * @returns A JWT subject-token provider suitable for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot read the
+ * token file or the file contains no token.
+ */
 export function k8sServiceAccountTokenProvider(
-  tokenPath: string = '/var/run/secrets/kubernetes.io/serviceaccount/token',
+  tokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token',
   config?: {
+    /** Reads token-file contents; defaults to Node.js `fs/promises.readFile`. */
     readFile?: ReadFile;
   },
 ): SubjectTokenProvider {
@@ -61,19 +78,45 @@ export function k8sServiceAccountTokenProvider(
   };
 }
 
+/**
+ * Retrieves an Azure managed-identity access token from the Instance Metadata Service.
+ *
+ * Run this provider in an Azure-hosted workload that can reach the link-local
+ * metadata endpoint. Select a user-assigned identity with `objectId`, `clientId`,
+ * or `msiResId`; otherwise Azure selects the available managed identity.
+ *
+ * @param resource Azure resource identifier; defaults to
+ * `https://management.azure.com/`.
+ * @param config Managed-identity selection, metadata API version, request
+ * timeout, and optional `fetch` implementation.
+ * @returns A JWT subject-token provider suitable for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot retrieve
+ * an access token, the metadata response is invalid, or the request times out.
+ */
 export function azureManagedIdentityTokenProvider(
   resource: string = DEFAULT_RESOURCE,
   config?: {
+    /** Object ID of the user-assigned managed identity to request. */
     objectId?: string;
+
+    /** Client ID of the user-assigned managed identity to request. */
     clientId?: string;
+
+    /** Azure resource ID of the user-assigned managed identity to request. */
     msiResId?: string;
+
+    /** Azure Instance Metadata Service API version; defaults to `2018-02-01`. */
     apiVersion?: string;
+
+    /** Metadata request timeout in milliseconds; defaults to 10,000. */
     timeout?: number;
+
+    /** Fetch implementation used for metadata requests; defaults to the runtime fetch. */
     fetch?: Fetch;
   },
 ): SubjectTokenProvider {
   const apiVersion = config?.apiVersion ?? DEFAULT_AZURE_API_VERSION;
-  const timeout = config?.timeout ?? 10000;
+  const timeout = config?.timeout ?? 10_000;
 
   return {
     tokenType: 'jwt',
@@ -133,11 +176,30 @@ export function azureManagedIdentityTokenProvider(
   };
 }
 
+/**
+ * Retrieves a Google Cloud identity token from the default service account's metadata endpoint.
+ *
+ * Run this provider in a Google Cloud workload with access to its Compute Engine
+ * metadata server. A fresh identity token is requested for each token exchange.
+ *
+ * @param audience Intended identity-token audience; defaults to
+ * `https://api.openai.com/v1`.
+ * @param config Optional metadata request timeout and `fetch` implementation.
+ * @returns An identity-token subject-token provider for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot retrieve
+ * a nonempty identity token or the metadata request times out.
+ */
 export function gcpIDTokenProvider(
-  audience: string = 'https://api.openai.com/v1',
-  config?: { timeout?: number; fetch?: Fetch },
+  audience = 'https://api.openai.com/v1',
+  config?: {
+    /** Metadata request timeout in milliseconds; defaults to 10,000. */
+    timeout?: number;
+
+    /** Fetch implementation used for metadata requests; defaults to the runtime fetch. */
+    fetch?: Fetch;
+  },
 ): SubjectTokenProvider {
-  const timeout = config?.timeout || 10000;
+  const timeout = config?.timeout || 10_000;
 
   return {
     tokenType: 'id',
@@ -163,7 +225,8 @@ export function gcpIDTokenProvider(
           throw new Error(`GCP Metadata Server returned ${response.status}: ${errorText}`);
         }
 
-        const token = (await response.text()).trim();
+        const tokenText = await response.text();
+        const token = tokenText.trim();
         if (!token) {
           throw new Error('GCP metadata server returned an empty token');
         }

package/src/auth/types.ts

@@ -1,28 +1,41 @@
+/** Supplies a fresh external identity token for an OpenAI workload-identity exchange. */
 export interface SubjectTokenProvider {
+  /** Whether the provider returns a signed JWT or an OpenID Connect identity token. */
   tokenType: 'jwt' | 'id';
+
+  /** Returns a fresh subject token whenever the SDK needs to exchange or refresh its access token. */
   getToken: () => Promise<string>;
 }
 
+/** Configures federation from an external workload identity into an OpenAI service account. */
 export interface WorkloadIdentity {
-  /**Optional client identifier for token exchange compatibility.*/
+  /** Optional OAuth client identifier included in the token-exchange request. */
   clientId?: string;
 
-  /**Identity provider resource id in WIFAPI.*/
+  /** Identifier of the OpenAI identity-provider resource that trusts the external workload. */
   identityProviderId: string;
 
-  /**OpenAI Service account id to bind the verified external identity to.*/
+  /** Identifier of the OpenAI service account that receives the verified external identity. */
   serviceAccountId: string;
 
-  /**The provider configuration for obtaining the subject token.*/
+  /** Provider that obtains the external subject token for each token exchange. */
   provider: SubjectTokenProvider;
 
-  /**Optional buffer time in seconds to refresh the OpenAI token before it expires. Defaults to 1200 seconds (20 minutes).*/
+  /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds. */
   refreshBufferSeconds?: number;
 }
 
+/** OAuth token-exchange response returned by the OpenAI workload-identity endpoint. */
 export interface TokenExchangeResponse {
+  /** OpenAI access token to use as the request's bearer credential. */
   access_token: string;
+
+  /** OAuth token-type URN describing the issued access token. */
   issued_token_type: string;
+
+  /** Authorization scheme associated with the access token, normally `Bearer`. */
   token_type: string;
+
+  /** Token lifetime in seconds; the SDK assumes 3,600 seconds when omitted. */
   expires_in?: number;
 }

package/src/auth/workload-identity-auth.ts

@@ -15,44 +15,74 @@ const SUBJECT_TOKEN_TYPES: Record<WorkloadIdentity['provider']['tokenType'], str
 
 const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
 
+/**
+ * Exchanges external workload-identity tokens for cached OpenAI access tokens.
+ *
+ * Concurrent token exchanges are shared. Valid cached tokens are returned while
+ * a proactive refresh runs in the background; expired or missing tokens wait
+ * for a successful exchange before they are returned.
+ */
 export class WorkloadIdentityAuth {
   private cachedToken: CachedToken | null = null;
   private refreshPromise: Promise<string> | null = null;
+  private tokenGeneration = 0;
   private readonly config: WorkloadIdentity;
   private readonly tokenExchangeUrl: string = 'https://auth.openai.com/oauth/token';
   private readonly fetch: Fetch;
 
+  /**
+   * Creates a workload-identity token cache and OAuth token-exchange client.
+   *
+   * @param config External identity provider, OpenAI service account, and refresh settings.
+   * @param fetch Optional fetch implementation for calls to the OpenAI token endpoint.
+   */
   constructor(config: WorkloadIdentity, fetch?: Fetch) {
     this.config = config;
     this.fetch = fetch ?? Shims.getDefaultFetch();
   }
 
+  /**
+   * Returns a valid OpenAI access token, exchanging or refreshing credentials as needed.
+   *
+   * Cached tokens nearing expiration are returned immediately while a background
+   * refresh runs. Concurrent callers share the same in-flight token exchange.
+   *
+   * @throws {OAuthError} When the token endpoint rejects the subject token or identity.
+   * @throws {APIError} When another unsuccessful HTTP response prevents token exchange.
+   * @throws {OpenAIError} When a successful exchange has an invalid access token or expiration.
+   */
   async getToken(): Promise<string> {
-    if (!this.cachedToken || this.isTokenExpired(this.cachedToken)) {
+    if (!this.cachedToken || WorkloadIdentityAuth.isTokenExpired(this.cachedToken)) {
       if (this.refreshPromise) {
         return await this.refreshPromise;
       }
 
-      this.refreshPromise = this.refreshToken();
+      const refreshPromise = this.refreshToken(this.tokenGeneration);
+      this.refreshPromise = refreshPromise;
 
       try {
-        const token = await this.refreshPromise;
-        return token;
+        return await refreshPromise;
       } finally {
-        this.refreshPromise = null;
+        if (this.refreshPromise === refreshPromise) {
+          this.refreshPromise = null;
+        }
       }
     }
 
     if (this.needsRefresh(this.cachedToken) && !this.refreshPromise) {
-      this.refreshPromise = this.refreshToken().finally(() => {
-        this.refreshPromise = null;
+      const refreshPromise = this.refreshToken(this.tokenGeneration).finally(() => {
+        if (this.refreshPromise === refreshPromise) {
+          this.refreshPromise = null;
+        }
       });
+      this.refreshPromise = refreshPromise;
+      void refreshPromise.catch(() => null);
     }
 
     return this.cachedToken.token;
   }
 
-  private async refreshToken(): Promise<string> {
+  private async refreshToken(generation: number): Promise<string> {
     const subjectToken = await this.config.provider.getToken();
     const body: Record<string, string> = {
       grant_type: TOKEN_EXCHANGE_GRANT_TYPE,
@@ -72,6 +102,7 @@ export class WorkloadIdentityAuth {
         'Content-Type': 'application/json',
       },
       body: JSON.stringify(body),
+      redirect: 'manual',
     });
 
     if (!response.ok) {
@@ -80,7 +111,9 @@ export class WorkloadIdentityAuth {
 
       try {
         body = JSON.parse(errorText);
-      } catch {}
+      } catch {
+        // Ignore non-JSON error bodies.
+      }
 
       if (response.status === 400 || response.status === 401 || response.status === 403) {
         throw new OAuthError(response.status as 400 | 401 | 403, body, response.headers);
@@ -106,17 +139,27 @@ export class WorkloadIdentityAuth {
 
     const accessToken = tokenResponse.access_token;
     const expiresIn = (tokenResponse as Partial<TokenExchangeResponse>).expires_in ?? 3600;
-    const expiresAt = Date.now() + expiresIn * 1000;
+    if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+      throw new OpenAIError("Token exchange response has invalid 'expires_in' field");
+    }
 
-    this.cachedToken = {
-      token: accessToken,
-      expiresAt,
-    };
+    const now = Date.now();
+    const expiresAt = now + expiresIn * 1000;
+    if (!Number.isSafeInteger(expiresAt) || expiresAt <= now) {
+      throw new OpenAIError("Token exchange response has invalid 'expires_in' field");
+    }
+
+    if (this.tokenGeneration === generation) {
+      this.cachedToken = {
+        token: accessToken,
+        expiresAt,
+      };
+    }
 
     return accessToken;
   }
 
-  private isTokenExpired(cachedToken: CachedToken): boolean {
+  private static isTokenExpired(cachedToken: CachedToken): boolean {
     return Date.now() >= cachedToken.expiresAt;
   }
 
@@ -126,7 +169,9 @@ export class WorkloadIdentityAuth {
     return Date.now() >= cachedToken.expiresAt - bufferMs;
   }
 
+  /** Discards the cached access token so the next request performs a fresh exchange. */
   invalidateToken(): void {
+    this.tokenGeneration += 1;
     this.cachedToken = null;
     this.refreshPromise = null;
   }

package/src/azure.ts

@@ -1,9 +1,10 @@
-import type { RequestInit } from './internal/builtin-types';
+import type { RequestInit, RequestInfo, Response } from './internal/builtin-types';
 import type { NullableHeaders } from './internal/headers';
 import { buildHeaders } from './internal/headers';
 import * as Errors from './error';
-import { FinalRequestOptions } from './internal/request-options';
+import type { FinalRequestOptions } from './internal/request-options';
 import { isObj, readEnv } from './internal/utils';
+import { path } from './internal/utils/path';
 import { OpenAI } from './client';
 import type { ClientOptions } from './client';
 
@@ -23,8 +24,9 @@ export interface AzureClientOptions extends Omit<ClientOptions, 'provider'> {
   endpoint?: string | undefined;
 
   /**
-   * A model deployment, if given, sets the base client URL to include `/deployments/{deployment}`.
-   * Note: this means you won't be able to use non-deployment endpoints. Not supported with Assistants APIs.
+   * Azure model deployment inserted into supported deployment-scoped request
+   * paths. The client's base URL remains unchanged, so non-deployment endpoints
+   * remain available.
    */
   deployment?: string | undefined;
 
@@ -42,25 +44,27 @@ export interface AzureClientOptions extends Omit<ClientOptions, 'provider'> {
 
 /** API Client for interfacing with the Azure OpenAI API. */
 export class AzureOpenAI extends OpenAI {
+  /** Azure deployment configured for deployment-scoped model requests. */
   deploymentName: string | undefined;
-  apiVersion: string = '';
+  /** Azure OpenAI API version included in requests made by this client. */
+  apiVersion = '';
 
   /**
    * API Client for interfacing with the Azure OpenAI API.
    *
-   * @param {string | undefined} [opts.apiVersion=process.env['OPENAI_API_VERSION'] ?? undefined]
-   * @param {string | undefined} [opts.endpoint=process.env['AZURE_OPENAI_ENDPOINT'] ?? undefined] - Your Azure endpoint, including the resource, e.g. `https://example-resource.azure.openai.com/`
-   * @param {string | undefined} [opts.apiKey=process.env['AZURE_OPENAI_API_KEY'] ?? undefined]
-   * @param {string | undefined} opts.deployment - A model deployment, if given, sets the base client URL to include `/deployments/{deployment}`.
-   * @param {string | null | undefined} [opts.organization=process.env['OPENAI_ORG_ID'] ?? null]
-   * @param {string} [opts.baseURL=process.env['OPENAI_BASE_URL']] - Sets the base URL for the API, e.g. `https://example-resource.azure.openai.com/openai/`.
-   * @param {number} [opts.timeout=10 minutes] - The maximum amount of time (in milliseconds) the client will wait for a response before timing out.
-   * @param {number} [opts.httpAgent] - An HTTP agent used to manage HTTP(s) connections.
+   * @param {string | undefined} [opts.apiVersion] - Defaults to `process.env['OPENAI_API_VERSION'] ?? undefined`.
+   * @param {string | undefined} [opts.endpoint] - Your Azure endpoint, including the resource, e.g. `https://example-resource.azure.openai.com/`. Defaults to `process.env['AZURE_OPENAI_ENDPOINT'] ?? undefined`.
+   * @param {string | undefined} [opts.apiKey] - Defaults to `process.env['AZURE_OPENAI_API_KEY'] ?? undefined`.
+   * @param {string | undefined} opts.deployment - Azure model deployment inserted into supported deployment-scoped request paths.
+   * @param {string | null | undefined} [opts.organization] - Defaults to `process.env['OPENAI_ORG_ID'] ?? null`.
+   * @param {string} [opts.baseURL] - Sets the base URL for the API, e.g. `https://example-resource.azure.openai.com/openai/`. Defaults to `process.env['OPENAI_BASE_URL']`.
+   * @param {number} [opts.timeout] - The maximum amount of time (in milliseconds) the client will wait for a response before timing out. Defaults to 10 minutes.
+   * @param {() => Promise<string>} [opts.azureADTokenProvider] - Returns a fresh Microsoft Entra access token for each request; cannot be combined with `apiKey`.
    * @param {Fetch} [opts.fetch] - Specify a custom `fetch` function implementation.
-   * @param {number} [opts.maxRetries=2] - The maximum number of times the client will retry a request.
+   * @param {number} [opts.maxRetries] - The maximum number of times the client will retry a request. Defaults to `2`.
    * @param {Headers} opts.defaultHeaders - Default headers to include with every request to the API.
    * @param {DefaultQuery} opts.defaultQuery - Default query parameters to include with every request to the API.
-   * @param {boolean} [opts.dangerouslyAllowBrowser=false] - By default, client-side use of this library is not allowed, as it risks exposing your secret API credentials to attackers.
+   * @param {boolean} [opts.dangerouslyAllowBrowser] - By default, client-side use of this library is not allowed, as it risks exposing your secret API credentials to attackers. Defaults to `false`.
    */
   constructor({
     baseURL = readEnv('OPENAI_BASE_URL'),
@@ -79,7 +83,7 @@ export class AzureOpenAI extends OpenAI {
     }
 
     if (typeof azureADTokenProvider === 'function') {
-      dangerouslyAllowBrowser = true;
+      dangerouslyAllowBrowser ??= true;
     }
 
     if (!azureADTokenProvider && !apiKey) {
@@ -112,37 +116,67 @@ export class AzureOpenAI extends OpenAI {
         endpointEnd--;
       }
       baseURL = `${endpoint.slice(0, endpointEnd)}/openai`;
-    } else {
-      if (endpoint) {
-        throw new Errors.OpenAIError('baseURL and endpoint are mutually exclusive');
-      }
+    } else if (endpoint) {
+      throw new Errors.OpenAIError('baseURL and endpoint are mutually exclusive');
     }
 
     super({
       apiKey: azureADTokenProvider ?? apiKey,
       baseURL,
       ...opts,
-      ...(dangerouslyAllowBrowser !== undefined ? { dangerouslyAllowBrowser } : {}),
+      ...(dangerouslyAllowBrowser === undefined ? {} : { dangerouslyAllowBrowser }),
     });
 
     this.apiVersion = apiVersion;
     this.deploymentName = deployment;
   }
 
+  /** Builds an Azure request and inserts its deployment into model-scoped endpoint paths. */
   override async buildRequest(
     options: FinalRequestOptions,
-    props: { retryCount?: number } = {},
-  ): Promise<{ req: RequestInit & { headers: Headers }; url: string; timeout: number }> {
+    props: {
+      /** Number of retries already attempted for the current request. */
+      retryCount?: number;
+    } = {},
+  ): Promise<{
+    /** Fetch request options after authentication, headers, and the body are prepared. */
+    req: RequestInit & {
+      /** Fully resolved request headers sent to Azure OpenAI. */
+      headers: Headers;
+    };
+    /** Absolute deployment-aware request URL. */
+    url: string;
+    /** Request timeout in milliseconds. */
+    timeout: number;
+  }> {
     if (_deployments_endpoints.has(options.path) && options.method === 'post' && options.body !== undefined) {
       if (!isObj(options.body)) {
         throw new Error('Expected request body to be an object');
       }
       const model = this.deploymentName || options.body['model'] || options.__metadata?.['model'];
       if (model !== undefined && !this.baseURL.includes('/deployments')) {
-        options.path = `/deployments/${model}${options.path}`;
+        options.path = path`/deployments/${model}` + options.path;
       }
     }
-    return super.buildRequest(options, props);
+    const built = await super.buildRequest(options, props);
+    if (built.req.headers.has('api-key')) {
+      built.req.redirect = 'manual';
+    }
+    return built;
+  }
+
+  protected override async fetchWithAuth(
+    url: RequestInfo,
+    init: RequestInit,
+    timeout: number,
+    controller: AbortController,
+    schemes?: { bearerAuth?: boolean; adminAPIKeyAuth?: boolean },
+  ): Promise<Response> {
+    if (new Headers(init.headers).has('api-key')) {
+      init.redirect = 'manual';
+    }
+
+    return super.fetchWithAuth(url, init, timeout, controller, schemes);
   }
 
   protected override async authHeaders(

package/src/bedrock.ts

@@ -1,6 +1,8 @@
 import * as Errors from './error';
 import { OpenAI } from './client';
 import type { ApiKeySetter, ClientOptions } from './client';
+import { assertBedrockRequestOrigin, brand_privateBedrockClient } from './internal/bedrock';
+import type { RequestInit } from './internal/builtin-types';
 import type { NullableHeaders } from './internal/headers';
 import { buildHeaders } from './internal/headers';
 import type { FinalRequestOptions, RequestOptions } from './internal/request-options';
@@ -10,8 +12,11 @@ import type { ResponseStreamParams } from './lib/responses/ResponseStream';
 import * as API from './resources/index';
 import type * as ResponsesAPI from './resources/responses/responses';
 
-export interface BedrockClientOptions
-  extends Omit<ClientOptions, 'apiKey' | 'adminAPIKey' | 'baseURL' | 'workloadIdentity'> {
+/** Configures Amazon Bedrock's OpenAI-compatible endpoint and bearer-token authentication. */
+export interface BedrockClientOptions extends Omit<
+  ClientOptions,
+  'apiKey' | 'adminAPIKey' | 'baseURL' | 'workloadIdentity'
+> {
   /**
    * Bedrock bearer token used for authentication.
    *
@@ -100,14 +105,21 @@ function restoreBedrockStreamOutputText(responses: API.Responses): API.Responses
 
 /** API Client for interfacing with Amazon Bedrock's OpenAI-compatible endpoint. */
 export class BedrockOpenAI extends OpenAI {
+  /**
+   * Identifies this client to credential-bearing WebSocket helpers.
+   *
+   * @internal
+   */
+  readonly [brand_privateBedrockClient] = true;
+
   private readonly bedrockTokenProvider: ApiKeySetter | undefined;
 
   /**
    * API Client for interfacing with Amazon Bedrock's OpenAI-compatible endpoint.
    *
-   * @param {string | null | undefined} [opts.apiKey=process.env['AWS_BEARER_TOKEN_BEDROCK'] ?? null]
-   * @param {string | null | undefined} [opts.baseURL=process.env['AWS_BEDROCK_BASE_URL'] ?? derived from opts.awsRegion or AWS_REGION/AWS_DEFAULT_REGION]
-   * @param {string | undefined} [opts.awsRegion=process.env['AWS_REGION'] ?? process.env['AWS_DEFAULT_REGION'] ?? undefined]
+   * @param {string | null | undefined} [opts.apiKey] - Defaults to `process.env['AWS_BEARER_TOKEN_BEDROCK'] ?? null`.
+   * @param {string | null | undefined} [opts.baseURL] - Defaults to `process.env['AWS_BEDROCK_BASE_URL']`, or is derived from `opts.awsRegion`, `AWS_REGION`, or `AWS_DEFAULT_REGION`.
+   * @param {string | undefined} [opts.awsRegion] - Defaults to `process.env['AWS_REGION'] ?? process.env['AWS_DEFAULT_REGION'] ?? undefined`.
    * @param {ApiKeySetter | undefined} opts.bedrockTokenProvider - A function that returns a Bedrock bearer token and is invoked before each request.
    */
   constructor({
@@ -154,17 +166,44 @@ export class BedrockOpenAI extends OpenAI {
       ...opts,
     });
 
+    const trustedBaseURL = this.baseURL;
+    let currentBaseURL = trustedBaseURL;
+    Object.defineProperty(this, 'baseURL', {
+      enumerable: true,
+      configurable: false,
+      get() {
+        return currentBaseURL;
+      },
+      set(nextBaseURL: string) {
+        assertBedrockRequestOrigin(trustedBaseURL, nextBaseURL);
+        currentBaseURL = nextBaseURL;
+      },
+    });
+
     this.bedrockTokenProvider = bedrockTokenProvider;
     this.responses = restoreBedrockStreamOutputText(new API.Responses(this));
   }
 
   protected override async prepareOptions(options: FinalRequestOptions): Promise<void> {
+    const configuredBaseURL = this._options.baseURL ?? this.baseURL;
+    assertBedrockRequestOrigin(configuredBaseURL, this.buildURL(options.path, null, options.defaultBaseURL));
+
     const security = options.__security ?? { bearerAuth: true };
     if (security.adminAPIKeyAuth && !security.bearerAuth) {
       await this._callApiKey();
     }
 
     await super.prepareOptions(options);
+    assertBedrockRequestOrigin(configuredBaseURL, this.buildURL(options.path, null, options.defaultBaseURL));
+  }
+
+  protected override async prepareRequest(
+    request: RequestInit,
+    context: { url: string; options: FinalRequestOptions },
+  ): Promise<void> {
+    assertBedrockRequestOrigin(this._options.baseURL ?? this.baseURL, context.url);
+    await super.prepareRequest(request, context);
+    request.redirect = 'manual';
   }
 
   protected override async authHeaders(
@@ -179,9 +218,10 @@ export class BedrockOpenAI extends OpenAI {
     return super.authHeaders(opts, security);
   }
 
+  /** Clones this client while preserving its refreshable Bedrock token provider when appropriate. */
   override withOptions(options: Partial<BedrockClientOptions>): this {
     const bedrockTokenProvider =
-      options.apiKey !== undefined ? undefined : options.bedrockTokenProvider ?? this.bedrockTokenProvider;
+      options.apiKey === undefined ? (options.bedrockTokenProvider ?? this.bedrockTokenProvider) : undefined;
 
     return super.withOptions({
       ...options,