An AI Agent With a Wallet and a Spending Limit
AWS AgentCore Payments lets AI agents pay for APIs with stablecoin, within hard budget caps that prompt injection can't bypass.
I gave an AI agent a crypto wallet, pointed it at a paid API, and watched it settle the bill on its own. No human in the loop. The agent hit a paywall, signed a stablecoin microtransaction on Base Sepolia, and got back the content it needed. The whole payment took about two seconds.
This is AgentCore Payments, an AWS service that went GA in August 2026. It uses the x402 protocol to let agents pay for metered APIs, MCP servers, and paywalled content the same way a browser handles cookies: automatically, in the background, within limits a human sets in advance.
I ran the demo on testnet. Total cost: $0.002 in fake USDC. Here's what the setup looks like, what went wrong, and what it means for how agents will access paid services.
The Problem This Solves
Agents hit paywalls. A research agent browsing the web finds a page behind a paywall. A coding agent needs a premium API that charges per call. An MCP server wants $0.001 per query. Right now, the agent stops and asks a human, or you hardcode an API key and hope the bill doesn't spike.
Neither scales. The first breaks autonomy. The second has no spending controls and no per-request audit trail.
x402 is the HTTP-native answer. When a server wants payment, it returns HTTP 402 with a signed challenge describing what it costs, which network, which asset, who to pay. The client signs a stablecoin transaction, retries the request with the proof, and gets the content. It's the payment equivalent of a 401, auth header, retry flow.
AgentCore Payments handles the wallet, the signing, the spending limits, and the audit trail. The agent never touches credentials directly.
What the Agent Actually Does
Here's the flow in plain terms:
- Agent calls a paid endpoint
- Gets back HTTP 402 with an x402 challenge (amount, asset, recipient, network)
- AgentCore checks the session budget, signs the payment through the wallet provider
- Agent retries the request with the signed proof
- Gets 200 OK with the paid content
From the agent's perspective, it called a tool and got a response. The payment happened in the middleware.
Terminal showing wallet balance, session creation, and the agent hitting the paid endpoint
The agent calls http_request, gets the 402, and the plugin handles the rest. Here's what came back:
The fortune response from Node4All after successful x402 payment
Full agent response showing x402 protocol details and payment confirmation
The Setup (What It Actually Takes)
The docs make this sound like five API calls. In practice, I hit every wall along the way. Here's the honest version.
Prerequisites
- AWS account with AgentCore access (us-east-1)
- A wallet provider: Stripe/Privy or Coinbase CDP
- Python 3.10+ with the
bedrock-agentcoreSDK and Strands Agents - The AgentCore CLI (
npm install -g @aws/agentcore)
Wallet Provider: Coinbase Was Geo-Blocked
My first attempt was Coinbase CDP. The portal at portal.cdp.coinbase.com returned 405 Not Allowed from Kenya. Geo-restricted at the edge.
Switched to Stripe/Privy. Dashboard at dashboard.privy.io works globally. You need four credentials: App ID, App Secret, Authorization ID, and a P-256 private key. Generate the key under Wallet Infrastructure → Authorization → New Key. Save the private key immediately. Privy only shows it once.
Deploy the Infrastructure
The AgentCore CLI handles the CloudFormation:
1
2
3
4
5
6
7
agentcore create --name paymentsdemo --framework strands --model-provider bedrock --memory none
cd paymentsdemo
agentcore add payment-manager --name blogdemomanager
agentcore add payment-connector --manager blogdemomanager --name privytestnet --provider StripePrivy \
--app-id "YOUR_APP_ID" --app-secret "YOUR_APP_SECRET" \
--authorization-id "YOUR_AUTH_ID" --authorization-private-key "YOUR_KEY_BASE64"
agentcore deploy -yThis creates the Payment Manager, stores credentials in AgentCore Identity (backed by Secrets Manager), provisions IAM roles, and deploys via CDK. Takes about three minutes.
Create the Wallet
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
from bedrock_agentcore.payments import PaymentManager
pm = PaymentManager(payment_manager_arn=PAYMENT_MANAGER_ARN, region_name="us-east-1")
instrument = pm.create_payment_instrument(
user_id="demo-user-1",
payment_connector_id=CONNECTOR_ID,
payment_instrument_type="EMBEDDED_CRYPTO_WALLET",
payment_instrument_details={
"embeddedCryptoWallet": {
"network": "ETHEREUM",
"linkedAccounts": [{"email": {"emailAddress": "you@example.com"}}]
}
}
)
wallet_address = instrument["paymentInstrumentDetails"]["embeddedCryptoWallet"]["walletAddress"]The wallet comes back ACTIVE immediately with Privy. No redirect URL needed.
Privy wallet hub after delegation, showing both wallets ready
The Step I Missed: Delegation
This is where I burned an hour. The wallet exists, but the agent has no permission to sign transactions with it. You need the wallet owner (the user linked by email) to explicitly grant the agent signing access.
Privy requires a browser-based approval flow. You run their reference frontend (a Next.js app from github.com/privy-io/aws-agentcore-sdk), log in with the linked email, and click "Give access." Only then can AgentCore sign on behalf of the wallet.
This is a security feature, not a bug. The agent acts as an authorized signer. The user retains ownership and can revoke at any time. But it means your setup isn't complete until a human clicks a button in a browser. The docs mention this, but it's easy to miss when you're deep in API calls.
Fund the Wallet
Testnet USDC from Circle's faucet (faucet.circle.com). Select Base Sepolia, paste the wallet address, get 20 free USDC. Make sure you pick Base Sepolia, not Ethereum Sepolia. The sandbox endpoint settles on Base.
Circle faucet confirming 20 testnet USDC sent to wallet
Create a Session and Run the Agent
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
# Budget cap: $5, expires in 60 minutes
session = pm.create_payment_session(
user_id="demo-user-1",
limits={"maxSpendAmount": {"value": "5.00", "currency": "USD"}},
expiry_time_in_minutes=60
)
# Wire the agent
config = AgentCorePaymentsPluginConfig(
payment_manager_arn=PAYMENT_MANAGER_ARN,
user_id="demo-user-1",
payment_instrument_id=INSTRUMENT_ID,
payment_session_id=session["paymentSessionId"],
region="us-east-1",
)
plugin = AgentCorePaymentsPlugin(config=config)
agent = Agent(
system_prompt="You are a helpful assistant that can access paid APIs.",
tools=[http_request],
plugins=[plugin],
)
response = agent("Access the premium endpoint at https://sandbox.node4all.com/v1/x402-test")The agent hits the endpoint, gets 402, the plugin handles the x402 negotiation, AgentCore signs through Privy, the agent retries with proof, and gets the content.
The Result
1
2
3
[SESSION] Budget: $5.00 | Spent: $0.002 | Remaining: $4.998
[WALLET] Before: 19.996 USDC | After: 19.994 USDC
[CHAIN] Base Sepolia (eip155:84532) | Protocol: x402-v2The agent paid $0.002 for a single API call. The session budget decremented. The wallet balance dropped by the same amount. If the session expires or the budget runs out, further payments fail. The agent can't spend beyond what the human approved.
Post-payment status showing session budget, wallet balance change, and chain details
The Spending Controls Are Deterministic
This is the part that matters for production. The budget enforcement isn't in the prompt. It's not a guardrail the model might ignore. It's not a "please don't spend more than $5" instruction. It's a hard check at the API layer.
When a payment would exceed
maxSpendAmount or the session has expired, AgentCore rejects the ProcessPayment call before anything gets signed. The agent gets an error, not a warning. There's no way for prompt injection or confused reasoning to bypass the budget. The model never sees the wallet credentials, they live in Secrets Manager and AgentCore retrieves them at signing time.Per-session: you set a dollar amount and an expiry. Short sessions (60 minutes or less) are recommended. Create a fresh one per interaction.
Per-wallet: you can attach Privy policies for recipient allowlists or denylists (block sanctioned addresses, for example).
Per-agent: auto-payment can be disabled, requiring explicit human approval for each transaction.
What Doesn't Exist Yet
Being honest about the limits.
The merchant side is tiny. Right now, x402 merchants are a handful of sandbox endpoints and a few early adopters. The protocol is sound but adoption is early. You can browse what exists at x402scan.com.
Coinbase CDP is geo-restricted. If you're in Africa (confirmed from Kenya), the Coinbase developer portal is blocked. Privy works globally, but the delegation flow requires a frontend. There's no CLI-only path for the full setup.
Testnet only for free. Mainnet transactions cost real USDC plus gas. The demo is free because testnet USDC comes from a faucet. Production means real money.
Only stablecoin. No fiat card-to-API payments. The agent pays in USDC. End users fund the wallet through crypto transfer, or through cards/Apple Pay/ACH (mainnet, via Privy's onramp, region-dependent).
The delegation step requires a browser. You can't fully automate the setup in a script. A human has to log in and click "Give access" once per wallet. Privy won't delegate on behalf of the user. The user must trigger it from a provisioned device.
When You'd Use This (vs. Just Using API Keys)
API keys work fine for services where you have an account, a subscription, and predictable usage. AgentCore Payments makes sense when:
- The agent discovers services at runtime (browsing, MCP tool discovery)
- You want per-request cost attribution, not a monthly bill you can't break down
- You need spending caps that survive prompt injection
- Multiple agents or users share infrastructure but need isolated budgets
- The service uses per-call pricing at fractions of a cent (where credit card minimums don't work)
The x402 model assumes a world where APIs are metered and agents consume them autonomously. We're not fully there yet. But the protocol and the infrastructure exist now.
Teardown
1
2
3
4
# Delete payment resources
agentcore destroy -y
# Or keep it for more testing, no charges when idleThe Payment Manager, Connector, and Instrument cost nothing when idle. You only pay for
ProcessPayment calls (Privy wallet operations, about $0.005 each). Testnet transactions are free.What I'd Build Next
The sandbox endpoint returns a fortune reading. That's fine for a demo. The real application is an agent that browses Coinbase's x402 Bazaar, discovers paid data feeds, and buys what it needs within a budget. Or an MCP orchestrator that calls paid tools without pre-registering API keys for each one.
AgentCore Guardrails (shipping separately) adds another layer: policy-based controls on what actions an agent can take before tool invocation. Combined with Payments, you get an agent that can only call approved tools, only pay approved recipients, only within an approved budget, with a full audit trail in CloudWatch. That's the post for next cycle.
Built and tested August 25-26, 2026 in us-east-1. Wallet provider: Stripe/Privy. Network: Base Sepolia testnet. Total cost: ~$0.01 in Privy wallet operations, $0 in USDC (testnet). AgentCore Payments went GA in August 2026. Screenshots and code are from a real run, not mocked.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article