Table of Contents
Amazon Bedrock AgentCore payments (preview) lets agents pay for APIs, MCP servers, web content, and other agents with USDC micropayments. At preview, the path is x402 (HTTP 402): the agent hits a paid endpoint, AgentCore signs via a Coinbase or Stripe Privy wallet, presents payment proof, and retries for 200.
This guide covers the May 7, 2026 preview as of September 14, 2026: resources and regions, Coinbase Quick create vs manual, Stripe Privy, payment instruments and sessions, CLI/SDK/plugin paths, sandbox and x402 Bazaar, observability, and named downsides.
Key Takeaways
- Amazon Bedrock AgentCore payments (preview, May 7, 2026) lets agents pay for APIs, MCP servers, web content, and other agents via USDC micropayments.
- Wallets at preview: Coinbase CDP (Quick create or manual) or Stripe Privy; protocol path is x402 (HTTP 402→sign→retry 200); MPP is also mentioned in overview docs.
- Guardrails require end-user wallet authorization, per-session spend limits, and no open-ended access; example session is maxSpendAmount 5.00 USD with 60-minute expiry.
- Regions: us-east-1, us-west-2, eu-central-1, ap-southeast-2; wire via AgentCore CLI, SDK PaymentManager, Strands AgentCorePaymentsPlugin, or Boto3 bedrock-agentcore-control.
- Named downside: preview; Coinbase needs Marketplace subscription; instrument not ACTIVE until funded and signing granted; session expiry/budget blocks; not a full Agentic Wallet CLI replacement.
What AgentCore payments is (and isn't)
On May 7, 2026, AWS announced Amazon Bedrock AgentCore payments built with Coinbase and Stripe. The product is agent payment infrastructure inside Bedrock AgentCore so agents can transact with stablecoin micropayments.
The preview payment flow is:
- Agent calls a paid endpoint.
- Server returns HTTP 402.
- AgentCore signs the payment via the configured wallet.
- Agent retries with payment proof and receives 200.
Overview docs also mention MPP as supported alongside x402 at preview. Treat x402 as the concrete how-to path in getting-started materials.
AgentCore payments is not the same as a standalone Coinbase Agentic Wallet bootstrap, and it is not the buyer-only AgentKit x402 fetch wrapper. It sits in AWS: credentials, payment manager, connector, instrument, and session.
For protocol context, see x402 protocol.
Prerequisites and regions
AWS documents AgentCore payments preview in:
- us-east-1
- us-west-2
- eu-central-1
- ap-southeast-2
You need an AWS account with Bedrock AgentCore access, a Coinbase CDP or Stripe Privy wallet path, and (for Coinbase Quick create) an AWS Marketplace subscription for Coinbase Wallets for AgentCore Payments.
Skill path: Agent Toolkit for AWS aws-agents plugin and the agents-build skill.
AgentCore payment resources
AWS names these building blocks:
| Resource | Role |
|---|---|
| PaymentCredentialProvider | Holds wallet provider credentials (Coinbase or Stripe Privy) |
| Payment Manager | Orchestrates payment signing and retries |
| Payment Connector | Links manager to a credential provider |
| Payment Instrument | EMBEDDED_CRYPTO_WALLET instrument the agent spends from |
| Payment Session | Bounded spend window (amount + expiry) |
The instrument type in docs is EMBEDDED_CRYPTO_WALLET. Docs examples use network ETHEREUM. Funding goes through a redirectUrl that can accept crypto, card, Apple Pay, Google Pay, or ACH. For testnet USDC, use the Circle faucet.
Step 1. Choose Coinbase or Stripe Privy
Coinbase Quick create
Coinbase Quick create uses provisionMode QUICK_CREATE. The flow returns an authorizationUrl. Status moves from PENDING_AUTHENTICATION to READY after the user completes auth. Marketplace subscription for Coinbase Wallets for AgentCore Payments is required.
Coinbase manual
Manual Coinbase wiring needs:
- API Key ID
- API Key Secret
- Wallet Secret
- Delegated signing enabled
Stripe Privy (manual only)
Stripe Privy is manual-only in the docs:
- App ID
- App Secret
- Authorization ID
- Authorization Private Key
Pick Coinbase Quick create when you want AWS-managed provisioning. Pick manual Coinbase or Stripe Privy when credentials already live outside Quick create.
Step 2. Create instrument and fund USDC
Create a payment instrument of type EMBEDDED_CRYPTO_WALLET on the chosen network (docs example: ETHEREUM). The instrument is not ACTIVE until the end user funds it and grants signing.
Open the provider redirectUrl to fund. Funding options documented include crypto, card, Apple Pay, Google Pay, and ACH. For sandbox/testnet USDC, pull from the Circle faucet.
Guardrails AWS documents:
- End user must authorize the wallet
- Per-session spend limits
- No open-ended access
Step 3. Open a payment session with spend caps
Create a Payment Session before unattended spend. AWS docs show an example with maxSpendAmount 5.00 USD and expiry 60 minutes.
When the session budget or expiry is hit, further payment signatures fail until a new session is opened. Treat that as a feature, not a bug, for agent loops.
Step 4. Wire CLI, SDK, plugin, or Boto3
AWS documents several integration surfaces:
| Surface | Entry points |
|---|---|
| AgentCore CLI | agentcore add payment-manager / payment-connector / deploy / invoke |
| AgentCore SDK | PaymentManager |
| Strands | AgentCorePaymentsPlugin |
| Boto3 | bedrock-agentcore-control |
Skill path for agent builders: Agent Toolkit for AWS aws-agents plugin plus the agents-build skill.
Step 5. Test sandbox and discover x402 Bazaar
AWS documents a sandbox test endpoint: https://sandbox.node4all.com/v1/x402-test.
Use it to exercise the 402→sign→retry loop without production spend. Through AgentCore Gateway, agents can reach x402 Bazaar with 10,000+ endpoints.
Seller-side accept patterns live in how to accept x402 USDC payments from AI agents. Circle nanopayments are a different stack: how to make a Circle agent nanopayment in USDC.
Observability
AWS documents CloudWatch logs and X-Ray spans for AgentCore payment flows. Use them to trace 402 responses, signing failures, session budget blocks, and successful 200 retries.
Stablecoin Insider's take
FAQ
What is Amazon Bedrock AgentCore payments?
A May 7, 2026 preview feature that lets Bedrock agents pay for APIs, MCP servers, web content, and other agents with USDC micropayments via Coinbase or Stripe Privy wallets and x402.
Which wallets work at preview?
Coinbase CDP (Quick create or manual) and Stripe Privy (manual only). Coinbase Quick create requires Marketplace subscription for Coinbase Wallets for AgentCore Payments.
How does the x402 flow work in AgentCore?
Agent hits a paid endpoint, receives HTTP 402, AgentCore signs via the wallet, retries with payment proof, and gets 200 on success.
What spend limits should be set?
AWS docs show an example session with maxSpendAmount 5.00 USD and 60-minute expiry. End-user wallet authorization and per-session limits are required; open-ended access is not supported.
Which regions support AgentCore payments preview?
us-east-1, us-west-2, eu-central-1, and ap-southeast-2.
Is this the same as Coinbase Agentic Wallet CLI?
No. AgentCore payments is AWS-hosted payment infrastructure for Bedrock agents. Agentic Wallet CLI is a separate Coinbase wallet bootstrap for hold/send/trade/pay.
Next step
Read the AWS AgentCore payments getting-started guide, pick Coinbase Quick create or Stripe Privy, create an EMBEDDED_CRYPTO_WALLET instrument, fund testnet USDC, open a session with a tight maxSpendAmount and expiry, then hit the sandbox x402 test endpoint before any production invoke.
Read AWS AgentCore payments getting started, then compare the Coinbase Agentic Wallet bootstrap when you need a standalone wallet CLI.
This content is provided for informational and educational purposes only and does not constitute financial, investment, legal, or tax advice; no material herein should be interpreted as a recommendation, endorsement, or solicitation to buy or sell any financial instrument, and readers should conduct their own independent research or consult a qualified professional.
){kind=link}