Amazon Bedrock AgentCore Payments: x402 vs MPP Guide

Quick answer

Amazon Bedrock AgentCore payments is a separate payment layer for agents accessing paid APIs, MCP servers, and content. A PaymentManager owns a provider connector; AgentCore Identity protects connector credentials; the end user funds a wallet and grants revocable delegation outside the agent; and each PaymentSession sets a maximum spend, currency, and expiry for one interaction.

x402 and the Machine Payments Protocol (MPP) use the same high-level lifecycle—challenge, limit check, signing, retry, settlement, and ledger update—but different HTTP challenge and proof headers. Choose the protocol required by the merchant. Do not treat protocol support as authorization to pay any merchant.

The managed payment boundary

Component	Responsibility	Boundary to preserve
PaymentManager	Top-level service configuration	Does not fund a user’s wallet
PaymentConnector	Integrates a supported wallet provider	Provider credentials belong in AgentCore Identity
Payment instrument	Represents the user’s payment credential or wallet	Starts unfunded and requires explicit delegation
PaymentSession	Enforces maxSpendAmount, currency, and expiry	Per interaction, not an account-wide budget
ProcessPayment	Checks, signs, and records a payment attempt	Application still validates user and merchant

AWS documents Coinbase CDP and Stripe Privy connector paths. Availability, wallet funding methods, networks, fees, geography, and provider terms can differ. Verify the exact connector and signed-in account rather than generalizing from the GA announcement.

x402 versus MPP flow

1. The agent requests a paid resource through AgentCore Gateway or a direct endpoint.
2. The merchant returns a payment challenge.
3. AgentCore payments checks the active session’s remaining spend and expiry.
4. The service retrieves protected wallet credentials through AgentCore Identity and creates a signed proof through the connector.
5. The agent retries the original resource request.
6. The merchant verifies and settles the payment, then returns the resource.
7. AgentCore updates the session ledger; on failure, AWS says the spend reservation is released and the transaction is recorded as failed.

For x402, the retry carries the signed payload in X-PAYMENT. For MPP, the merchant challenge is WWW-Authenticate: Payment and the retry carries a signed credential in Authorization. Those header differences do not change the need for identity, budget, merchant, retry, and audit controls.

Controls that remain outside the protocol

• Verify the end user; AWS notes an IAM-configured PaymentManager does not perform end-user verification for a multi-tenant app.
• Keep wallet funding and delegation outside the agent. Never put card data, bank details, private keys, or wallet secrets into prompts or tool arguments.
• Use the four-role IAM pattern so one role cannot both raise a session budget and spend it.
• Set a conservative maxSpendAmount and short expiry from the real task contract.
• Allowlist trusted payTo addresses. AWS does not enforce recipient restrictions server-side, and a model must not generate the recipient address.
• Make retries idempotent and bounded; do not turn a network timeout into duplicate settlement.
• Use CloudWatch vended logs and X-Ray spans for payment lifecycle evidence, then reconcile with provider and accounting records.

AgentCore Policy is complementary: it decides whether a tool and parameters may run. PaymentSession limits money for a payment interaction. Harness execution limits control iterations, time, and tokens. A durable ledger owns cross-session exposure. None should silently substitute for another.

Run the AgentCore payments readiness checker before a pilot. For temporal approvals and aggregation boundaries, use the human approval and budget cap guide.

Frequently asked questions

What is Amazon Bedrock AgentCore payments?

It is an AWS service for agents to pay for supported APIs, MCP servers, and content through managed payment sessions, wallet connectors, supported payment protocols, and lifecycle observability.

What is the difference between x402 and MPP?

The challenge and proof headers differ. x402 retries with X-PAYMENT; MPP uses WWW-Authenticate: Payment and retries with a signed credential in Authorization. The control model remains the same.

Does a PaymentSession replace AgentCore Policy?

No. Policy controls whether a tool and parameters may be called. PaymentSession controls maximum spend, currency, and expiry for a payment context. Identity, explicit consent, merchant validation, idempotency, and global accounting remain separate.

Official sources

• AWS: AgentCore payments generally available
• AWS: How AgentCore payments works
• AWS: AgentCore payments security best practices

Source check: August 20, 2026. Recheck supported Regions, connectors, protocols, wallet networks, pricing, quotas, IAM actions, and provider terms before production use.