AWS previews Bedrock AgentCore USDC payments

Amazon Web Services on May 7, 2026 opened a preview of Amazon Bedrock AgentCore payments, a feature that allows Bedrock agents to make micropayments in USDC for APIs, MCP servers, web content and transactions with other agents. The preview uses an x402 protocol flow: an agent calls a paid endpoint, the endpoint returns HTTP 402, AgentCore uses a configured wallet to sign a payment proof, and the agent retries the request to receive HTTP 200 on success. The preview is available in us-east-1, us-west-2, eu-central-1 and ap-southeast-2.

The service includes several AWS-managed resources. A PaymentCredentialProvider stores Coinbase CDP or Stripe Privy credentials. A Payment Manager handles payment signing and retry logic. A Payment Connector links the manager to the credential provider. Agents spend from a Payment Instrument of type EMBEDDED_CRYPTO_WALLET. Payment Sessions set a spend limit and an expiry to bound unattended spending. Funding of the embedded instrument occurs through a provider redirect URL that accepts crypto, card, Apple Pay, Google Pay or ACH. Testnet USDC can be obtained from the Circle faucet. The payment instrument becomes active only after an end user funds it and grants signing permission.

AWS documents two Coinbase wiring paths plus a Stripe Privy option. Coinbase Quick create uses a QUICK_CREATE provision mode and returns an authorization URL; it requires an AWS Marketplace subscription for the Coinbase Wallets for AgentCore Payments listing. Coinbase manual wiring requires an API key ID, API key secret, a wallet secret and delegated signing enabled. Stripe Privy is manual-only and requires app credentials and authorization keys. While AWS documentation mentions multi-party payments in overview materials, x402 is presented as the concrete how-to flow in the getting-started guide.

Developers can integrate AgentCore payments through the AgentCore CLI, the AgentCore SDK PaymentManager, the Strands AgentCorePaymentsPlugin, or Boto3’s bedrock-agentcore-control. AWS lists the Agent Toolkit for AWS and the aws-agents plugin as the recommended skill path for agent builders. A sandbox x402 test endpoint (https://sandbox.node4all.com/v1/x402-test) is available for exercising the 402→sign→retry loop without using production funds. Through the AgentCore Gateway, agents can reach a broader x402 marketplace of endpoints.

Observability for payment flows is provided by CloudWatch logs and AWS X-Ray spans, which can surface HTTP 402 responses, signing failures, session budget blocks and successful retries. Guardrails require end-user wallet authorization, per-session spend limits and expiration; example documentation shows a session capped at a maxSpendAmount of 5.00 USD with a 60-minute expiry. When a session’s budget or expiry is reached, payment signatures will fail until a new session is opened.

At preview, limitations include the requirement for a Marketplace subscription to use Coinbase Quick create, the inactive state of payment instruments until funded and authorized, and that AgentCore payments is an AWS-hosted agent payment infrastructure rather than a standalone wallet command-line tool. For testing, AWS directs users to create an EMBEDDED_CRYPTO_WALLET instrument on a supported network, fund it, open a payment session with explicit spend limits and expiry, and verify behavior against the sandbox x402 test endpoint before invoking production calls.