AMAZON BEDROCK / SERVICE DETAIL S12 PAYMENTS

AGENTCORE PAYMENTSPRACTICAL

CHAPTER 28 / 36
TOPIC wallet, budget, then the agent pays an x402 endpoint
REV 2026.07

IN PLAIN WORDS

You will set up a managed wallet, give it a budget, and let a Strands agent pay a paid endpoint automatically when it hits an HTTP 402. Terms: credential provider = your wallet provider's keys (stored in Identity); manager + connector = the managed plumbing; instrument = the actual wallet; session = a budget + time limit.

$ pip install boto3 bedrock-agentcore[strands-agents] strands-agents strands-agents-tools $ aws sts get-caller-identity # region: us-east-1, us-west-2, eu-central-1, ap-southeast-2

First get keys from a wallet provider: Coinbase CDP (API Key ID, API Key Secret, Wallet Secret) or Stripe / Privy (App ID, App Secret, Authorization ID + Private Key).

[ 1 ] SET UP THE PLUMBING (control plane)

import boto3, time
cp = boto3.client("bedrock-agentcore-control", region_name="us-west-2")

cred = cp.create_payment_credential_provider(          # keys are kept in AgentCore Identity
    name="my-coinbase-credentials", credentialProviderVendor="CoinbaseCDP",
    coinbaseCdpConfig={"apiKeyId":"...", "apiKeySecret":"...", "walletSecret":"..."})

mgr = cp.create_payment_manager(name="pm", authorizerType="AWS_IAM", roleArn="<role-arn>")
while cp.get_payment_manager(paymentManagerArn=mgr["paymentManagerArn"])["status"] != "READY":
    time.sleep(5)
conn = cp.create_payment_connector(paymentManagerArn=mgr["paymentManagerArn"], name="conn",
    paymentConnectorType="CoinbaseCDP", credentialProviderArn=cred["credentialProviderArn"])

[ 2 ] CREATE A FUNDED WALLET AND A BUDGET (data plane)

import uuid
dp = boto3.client("bedrock-agentcore", region_name="us-west-2")

inst = dp.create_payment_instrument(userId="test-user-123", paymentManagerArn=PM_ARN,
    paymentConnectorId=CONN_ID, paymentInstrumentType="EMBEDDED_CRYPTO_WALLET",
    paymentInstrumentDetails={"embeddedCryptoWallet":{"network":"ETHEREUM",
        "linkedAccounts":[{"email":{"emailAddress":"you@example.com"}}]}}, clientToken=str(uuid.uuid4()))
print("Fund the wallet here:", inst["paymentInstrumentDetails"]["redirectUrl"])   # user funds (testnet USDC) + allows signing, then poll until ACTIVE

sess = dp.create_payment_session(userId="test-user-123", paymentManagerArn=PM_ARN,
    expiryTimeInMinutes=60, limits={"maxSpendAmount":{"value":"5.00", "currency":"USD"}},
    clientToken=str(uuid.uuid4()))                          # budget: $5, for 60 minutes
SESSION_ID = sess["paymentSessionId"]

[ 3 ] LET THE AGENT PAY, AUTOMATICALLY (Strands)

from strands import Agent
from strands_tools import http_request
from bedrock_agentcore.payments.integrations.config import AgentCorePaymentsPluginConfig
from bedrock_agentcore.payments.integrations.strands.plugin import AgentCorePaymentsPlugin

plugin = AgentCorePaymentsPlugin(config=AgentCorePaymentsPluginConfig(
    payment_manager_arn=PM_ARN, user_id="test-user-123",
    payment_instrument_id=INSTRUMENT_ID, payment_session_id=SESSION_ID, region="us-west-2"))

agent = Agent(system_prompt="You can access paid APIs.", tools=[http_request], plugins=[plugin])
print(agent("Access the premium endpoint at https://example-x402-merchant.com/paid-api"))  # handles the 402 + pays

print(dp.get_payment_session(paymentManagerArn=PM_ARN, paymentSessionId=SESSION_ID).get("spentAmount"))  # what it spent

The wallet must be funded and authorized by the user (open the redirect URL) before the agent can pay. When the budget or the session time runs out, payments are denied. Clean up with delete_payment_instrument / connector / manager.

SRC: AWS AgentCore Developer Guide (payments overview, payments quick start)

DRAWN 2026.06, REV 2026.07.26