The short answer
On August 18, 2026, AWS moved Bedrock AgentCore Payments from preview to general availability. The service lets AI agents built on Amazon Bedrock autonomously pay for paid APIs, MCP servers, and paywalled web content in the same way a human developer would swipe a card — except the transaction happens automatically, in cents, with no human in the loop. Wallets: Coinbase and Stripe Privy (stablecoin-based). Protocols: x402 and the newly added Machine Payment Protocol (MPP). Payment limits enforced deterministically at the infrastructure layer, not inside the model.
This is the first managed cloud service from a major hyperscaler to productionize agentic payments at enterprise scale. For teams building autonomous agent systems on AWS, it removes the last friction point in the tool-discovery loop: agents can now not only find a paid tool but pay for it and use it without pausing for authorization.
What does AWS AgentCore Payments do?
The core problem AgentCore Payments solves is straightforward: agents are increasingly good at composing tools to complete tasks, but until now they hit a hard stop when any tool required payment. The agent would need a pre-provisioned API key and subscription, which had to be set up manually by a developer before the agent ran. This worked for known tools but broke the dynamic discovery model that makes agentic systems valuable for open-ended tasks.
With AgentCore Payments, developers register a wallet (Coinbase or Stripe Privy) with the service, set per-session spending limits, and the agent handles the rest. When the agent discovers a paid endpoint — via the x402 or MPP protocol headers — AgentCore Payments intercepts the request, checks it against the session budget, derives a short-lived payment token, and completes the transaction. The agent sees a successful tool response. The developer sees a line in CloudWatch. Neither sees the raw wallet credentials, which are stored in AgentCore Identity Secrets Manager and never handed to the model.
The service integrates with Amazon Bedrock AgentCore Gateway, which exposes curated paid MCP endpoints from Coinbase — filterable by use case. It also works with content delivery infrastructure: both Amazon CloudFront and Cloudflare have partnered with AWS to let publishers charge agents for paywalled content on a per-request basis over x402. This creates a direct revenue path for content and data providers whose business models previously depended on blocking AI crawlers.
What changed from Preview (May) to GA (August)?
AWS launched AgentCore Payments in preview in May 2026 with support for the x402 payment protocol and a basic Coinbase wallet integration. The August GA release added several meaningful changes:
- Machine Payment Protocol (MPP) support. MPP, co-authored by Stripe and Tempo, is a second open standard for machine-to-machine payments. Adding it at GA means agents can pay any MPP-compatible endpoint without code changes — the protocol selection is handled by AgentCore automatically.
- The “upto” x402 payment scheme. At preview, x402 only supported fixed-price transactions (“exact” scheme). GA adds “upto”, which lets a merchant charge for exactly what was consumed at the end of a call rather than committing to a fixed price upfront. This unlocks genuine pay-per-inference: an LLM API can now charge based on actual token usage rather than a pre-set call fee.
- Quick Create for Coinbase. At preview, developers had to provision Coinbase credentials outside AWS and paste them into AgentCore. GA adds a Quick Create option directly in the AgentCore console and CLI, eliminating that round-trip.
- Enhanced endpoint discovery. The curated MCP endpoint list in AgentCore Gateway was updated to surface high-quality paid endpoints based on social proof, metadata richness, description quality, and uptime — reducing noise in tool selection for general-purpose agents.
How do payment sessions and enterprise guardrails work?
The guardrail mechanism is the part that matters most for production deployments. AI agents are non-deterministic — they can misinterpret a response as authorization to spend, or repeat a payment because of an unexpected retry. AgentCore Payments addresses this with a payment session model:
Every agent interaction runs inside a payment session scoped by two configurable caps: a maximum total spend amount in a specified currency, and an expiry timestamp. Before AgentCore signs any payment, it checks the pending transaction against the session budget. If the transaction would exceed the cap, it is rejected. This check runs at the infrastructure layer — outside the model — so the agent cannot reason around it or override it.
Observability is provided through integration with AgentCore Observability and Amazon CloudWatch. Vended logs capture the full payment lifecycle; vended spans enable distributed tracing. Pre-built dashboards show transaction success rates, average transaction values, and per-agent spending breakdowns. For teams operating multi-agent systems where individual agents may be spawning sub-agents that also transact, this audit trail is the primary control surface.
Who is already using AgentCore Payments?
AWS disclosed several early adopters in the GA announcement blog post, providing a useful read on which use cases are production-ready:
- Anchor Browser (cloud browser automation for enterprises) integrated AgentCore Payments to let its agents unlock paywalled web content during research and automation workflows. The integration abstracts the payment step from the browser agent entirely.
- Travala (travel booking) integrated AgentCore Payments into their MCP server, enabling agents using Claude and other models to book hotels conversationally in a single chat interaction — including payment. The example is notable because it spans discovery, booking, and payment as a unified agentic flow without a human checkout step.
- SpreadX used AgentCore Payments in their Incarna product to pay for LLM inference on a per-call basis through BlockRun, an inference marketplace that routes between model providers. This is the pay-per-inference use case made operational: an agent dynamically selects the cheapest available model for each call and pays exactly for what it uses.
What does this mean for US and EU software teams?
For teams building on AWS Bedrock: AgentCore Payments is now a first-class capability in the Bedrock agent stack. If your agent workflows involve accessing paid data sources, calling metered inference endpoints, or automating e-commerce or travel booking flows, this removes the pre-provisioned-subscription bottleneck. The practical architecture question shifts: instead of managing a static list of pre-approved paid tools, you define a spending policy and let the agent discover tools dynamically. This is a meaningfully different mental model for agent design — and one that requires careful thought about what a rogue or misbehaving agent could spend on your behalf.
For fintech and e-commerce teams: The compliance picture is not yet fully resolved. AWS has not issued a PCI DSS attestation specifically for AgentCore Payments as of the GA announcement. The architecture reduces credential exposure (short-lived derived tokens, secrets in Identity Secrets Manager, no raw credentials visible to the model), but teams in PCI DSS scope still need legal and compliance review before deploying payment-capable agents against production card-data environments. For EU teams, PSD2 strong customer authentication requirements also deserve scrutiny in any agentic payment flow involving consumer funds, even in the stablecoin context.
For teams not on AWS: This GA launch establishes a new category benchmark. Google, Microsoft, and infrastructure-agnostic providers will follow with comparable capabilities — the question is when, not if. The x402 and MPP protocols that AgentCore implements are open standards, which means any framework or platform can support the same payment flows. Teams building agent infrastructure on non-AWS stacks should track these protocol specifications if they plan to support dynamic tool discovery in the next 12–18 months.
On cost governance: The per-session spending cap is a necessary but not sufficient control for production deployments. A cap of, say, $10 per session sounds conservative until you consider an agent running 500 sessions per hour as part of a batch workflow. The real governance surface is the combination of per-session limits, per-agent daily budgets, and the observability dashboards that surface anomalous spending before it compounds. Teams adopting AgentCore Payments should build cost alerting from day one, not as an afterthought.
Frequently asked questions
What wallets does AWS AgentCore Payments support?
AgentCore Payments integrates with two stablecoin wallet providers: Coinbase and Stripe Privy. Both are purpose-built for cost-effective microtransactions, typically in the range of cents per call. At GA, AWS added a Quick Create option for Coinbase directly inside the AgentCore console, so developers can provision wallet credentials without leaving the AWS interface. Stripe Privy credentials are obtained from the Privy dashboard and supplied to AgentCore separately.
What are the x402 and Machine Payment Protocol (MPP) standards?
x402 is an open HTTP payment protocol — named after the rarely-used HTTP 402 “Payment Required” status code — that lets a server advertise a price for a resource and accept payment proof in the same request cycle. Machine Payment Protocol (MPP) is a complementary standard co-authored by Stripe and Tempo for machine-to-machine payments. AWS AgentCore Payments launched with x402 support in May 2026 and added MPP at GA in August. Both are protocol-agnostic from the developer’s perspective — AgentCore abstracts the differences so agents can pay any compliant endpoint without code changes.
How do payment sessions prevent runaway agent spending?
AgentCore Payments scopes each agent interaction inside a payment session with two configurable caps: a maximum spend amount in a specified currency, and an expiry timestamp. Before signing any payment, AgentCore checks the request against the session budget at the infrastructure layer and rejects requests that would exceed the cap. Because the check runs deterministically outside the model, an agent cannot reason its way around it. Expired sessions also reject new transactions automatically, preventing long-running agents from continuing to spend after their authorized window closes.
Does AWS AgentCore Payments interact with PCI DSS compliance requirements?
AWS has not issued a formal PCI DSS attestation specifically for AgentCore Payments as of the GA announcement. The architecture is designed to minimize credential exposure: raw wallet credentials are stored in AgentCore Identity Secrets Manager, and the agent operates on short-lived derived tokens rather than the credentials themselves. For teams building fintech or e-commerce agents under PCI DSS scope, this reduces — but does not eliminate — the compliance surface. Legal and compliance review is required before deploying payment-capable agents in regulated payment card environments. EU teams should also evaluate PSD2 strong customer authentication implications for any agentic payment flow touching consumer accounts.
Sources
AWS Machine Learning Blog — Amazon Bedrock AgentCore Payments is now generally available, August 18, 2026
AWS What’s New — AgentCore payments is now generally available in Amazon Bedrock AgentCore, August 18, 2026
Cloud Wars — Amazon Bedrock AgentCore Payments enables AI agents to transact using micropayments, August 2026