Create a Payment Manager and Connector

Step 1: Open the Payments page

Step 2: Configure Payment Manager details

Step 3: Configure permissions

The Permissions section specifies the permissions for this Payment Manager and the AWS resources that the payment can access.

For IAM Permissions, choose one of the following options:

Step 4: Configure inbound authorization

Inbound authorization controls who can access this Payment Manager. In the Inbound Auth section, for Inbound Auth type, choose one of the following options:

To use IAM authorization:

To use JWT authorization with Amazon Cognito:

To use JWT authorization with an existing identity provider:

Step 5: Add a payment connector (optional)

Payment connectors store the credentials and configuration needed to connect with payment service providers. Adding a connector during creation is optional, but a connector is required for the service to process payments.

Create payment auth

When you choose create a new one in the connector’s Payment auth section, the Create payment auth panel opens. In this panel, you configure a new payment auth — a payment credential provider that is stored in AgentCore Identity.

If you choose Coinbase, choose how to provide the credentials for the payment auth:

Use Quick create

If you select Quick create configurations - recommended, AgentCore payments creates the payment auth for you after you authorize access through Coinbase. Complete the following steps:

Use existing configurations

If you select Use existing configurations, complete the following fields under Payment provider configurations, and then choose Create payment auth:

If you choose Stripe (Privy), complete the following fields under Payment provider configurations, and then choose Create payment auth:

Step 6: Create the Payment Manager

After you choose Create Payment Manager, the console navigates to the Payment Manager details page. A success banner confirms that the Payment Manager was created and provides the following next steps:

The Payment Manager details page includes sections for Payment connectors, Integration code templates, Inbound Auth, Observability metrics, and Log deliveries and tracing configuration.

The AgentCore CLI creates the credential provider, Payment Manager, and Payment Connector together from your project directory. Requires CLI v0.19.0 or later.

Interactive wizard:

agentcore add payment-manager

The wizard prompts for manager name, pattern, auto-payment toggle, spend limit, and optionally walks through adding a connector with provider credentials.

Coinbase — Quick create (recommended):

Quick create provisions the Coinbase credential provider for you, so you do not pass any API keys. Add the connector with the --quick-create flag, then deploy:

agentcore add payment-connector \
  --manager MyPaymentManager \
  --name CoinbaseConnector \
  --provider CoinbaseCDP \
  --quick-create

agentcore deploy

The CLI opens the Coinbase authorization flow. After you authorize, the service provisions the credentials and the connector reaches READY.

Coinbase CDP — Manual flow (non-interactive):

agentcore add payment-manager \
  --name MyPaymentManager \
  --auto-payment \
  --default-spend-limit 10.00

agentcore add payment-connector \
  --manager MyPaymentManager \
  --name CoinbaseConnector \
  --provider CoinbaseCDP \
  --api-key-id <YOUR_API_KEY_ID> \
  --api-key-secret <YOUR_API_KEY_SECRET> \
  --wallet-secret <YOUR_WALLET_SECRET>

agentcore deploy

Stripe (Privy) — Manual flow (non-interactive):

agentcore add payment-manager \
  --name MyPaymentManager \
  --auto-payment \
  --default-spend-limit 10.00

agentcore add payment-connector \
  --manager MyPaymentManager \
  --name StripePrivyConnector \
  --provider StripePrivy \
  --app-id <YOUR_APP_ID> \
  --app-secret <YOUR_APP_SECRET> \
  --authorization-id <YOUR_AUTHORIZATION_ID> \
  --authorization-private-key <YOUR_PRIVATE_KEY_BASE64>

agentcore deploy

Running agentcore deploy provisions IAM roles, stores credentials in AgentCore Identity, and creates the Payment Manager and Connector.

The AgentCore SDK supports Coinbase Quick create (shown first) and manual provisioning. The manual examples that follow pass provider credentials directly. They use the convenience method create_payment_manager_with_connector, which creates the Payment Manager, credential provider, and connector in a single call.

Coinbase — Quick create (recommended):

With Quick create, you create the connector with an empty credential_provider_configurations list and provision_mode="QUICK_CREATE". The connector returns status PENDING_AUTHENTICATION and an authorization URL. After you authorize through Coinbase, the service provisions the credential provider and the connector reaches READY.

import time
import webbrowser

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

connector = payment_client.create_payment_connector(
    payment_manager_id="<paymentManagerId>",
    name="CoinbaseConnector",
    connector_type="CoinbaseCDP",
    credential_provider_configurations=[],
    provision_mode="QUICK_CREATE",
)

# Authorize through Coinbase using the returned URL.
webbrowser.open(connector["authorizationUrl"])

# Terminal states that mean provisioning did not succeed.
TERMINAL_FAILURES = {
    "AUTHENTICATION_EXPIRED",
    "AUTHENTICATION_FAILED",
    "AWS_MARKETPLACE_SUBSCRIPTION_REQUIRED",
    "CREATE_FAILED",
}

# Poll until the connector reaches READY or fails.
while True:
    response = payment_client.get_payment_connector(
        payment_connector_id=connector["paymentConnectorId"]
    )
    status = response["status"]
    if status == "READY":
        break
    if status in TERMINAL_FAILURES:
        raise RuntimeError(f"Connector provisioning failed: {status}")
    time.sleep(5)

The authorization URL is valid for about 10 minutes. If it expires, the connector transitions to AUTHENTICATION_EXPIRED and you re-create it.

Coinbase CDP with IAM authorization:

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="MyPaymentManager",
    payment_manager_description="Payment manager for my agent.",
    authorizer_type="AWS_IAM",
    role_arn="arn:aws:iam::123456789012:role/MyPaymentRole",
    payment_connector_config={
        "name": "CoinbaseConnector",
        "description": "Coinbase CDP connector",
        "payment_credential_provider_config": {
            "name": "MyCoinbaseProvider",
            "credential_provider_vendor": "CoinbaseCDP",
            "credentials": {
                "api_key_id": "your-api-key-id",
                "api_key_secret": "your-api-key-secret",
                "wallet_secret": "your-wallet-secret",
            },
        },
    },
    wait_for_ready=True,
    max_wait=300,
    poll_interval=5,
)

payment_manager = response.get("paymentManager", {})
payment_connector = response.get("paymentConnector", {})
credential_provider = response.get("credentialProvider", {})

payment_manager_arn = payment_manager.get("paymentManagerArn")
payment_connector_id = payment_connector.get("paymentConnectorId")

print(f"Payment Manager ARN: {payment_manager_arn}")
print(f"Connector ID: {payment_connector_id}")

Coinbase CDP with JWT authorization:

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="CoinbasePaymentManagerJWT",
    payment_manager_description="Coinbase Payment Manager (JWT auth)",
    authorizer_type="CUSTOM_JWT",
    role_arn="arn:aws:iam::123456789012:role/BedrockAgentCoreFullAccess",
    payment_connector_config={
        "name": "coinbase-connector-jwt",
        "description": "Coinbase Connector (JWT)",
        "payment_credential_provider_config": {
            "name": "my-coinbase-provider-jwt",
            "credential_provider_vendor": "CoinbaseCDP",
            "credentials": {
                "api_key_id": "your-api-key-id",
                "api_key_secret": "your-api-key-secret",
                "wallet_secret": "your-wallet-secret",
            },
        },
    },
    wait_for_ready=True,
)

manager_arn = response["paymentManager"]["paymentManagerArn"]
connector_id = response["paymentConnector"]["paymentConnectorId"]
provider_arn = response["credentialProvider"]["credentialProviderArn"]

Stripe (Privy) with IAM authorization:

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="StripePaymentManager",
    payment_manager_description="Stripe + Privy Payment Manager (IAM auth)",
    authorizer_type="AWS_IAM",
    role_arn="arn:aws:iam::123456789012:role/BedrockAgentCoreFullAccess",
    payment_connector_config={
        "name": "stripe-privy-connector",
        "description": "Stripe + Privy Connector",
        "payment_credential_provider_config": {
            "name": "my-stripe-privy-provider",
            "credential_provider_vendor": "StripePrivy",
            "credentials": {
                "app_id": "your-privy-app-id",
                "app_secret": "your-privy-app-secret",
                "authorization_private_key": "your-authorization-private-key",
                "authorization_id": "your-authorization-id",
            },
        },
    },
    wait_for_ready=True,
)

manager_arn = response["paymentManager"]["paymentManagerArn"]
connector_id = response["paymentConnector"]["paymentConnectorId"]
provider_arn = response["credentialProvider"]["credentialProviderArn"]

Stripe (Privy) with JWT authorization:

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="StripePaymentManagerJWT",
    payment_manager_description="Stripe + Privy Payment Manager (JWT auth)",
    authorizer_type="CUSTOM_JWT",
    role_arn="arn:aws:iam::123456789012:role/BedrockAgentCoreFullAccess",
    payment_connector_config={
        "name": "stripe-privy-connector-jwt",
        "description": "Stripe + Privy Connector (JWT)",
        "payment_credential_provider_config": {
            "name": "my-stripe-privy-provider-jwt",
            "credential_provider_vendor": "StripePrivy",
            "credentials": {
                "app_id": "your-privy-app-id",
                "app_secret": "your-privy-app-secret",
                "authorization_private_key": "your-authorization-private-key",
                "authorization_id": "your-authorization-id",
            },
        },
    },
    wait_for_ready=True,
)

manager_arn = response["paymentManager"]["paymentManagerArn"]
connector_id = response["paymentConnector"]["paymentConnectorId"]
provider_arn = response["credentialProvider"]["credentialProviderArn"]

Create a Payment Manager with IAM authorization:

aws bedrock-agentcore-control create-payment-manager \
  --name "MyPaymentManager" \
  --authorizer-type AWS_IAM \
  --role-arn "arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole" \
  --region us-east-1

Create a Payment Manager with JWT authorization:

aws bedrock-agentcore-control create-payment-manager \
  --name "MyPaymentManager" \
  --authorizer-type CUSTOM_JWT \
  --role-arn "arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole" \
  --custom-jwt-authorizer-configuration '{
    "discoveryUrl": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_EXAMPLE/.well-known/openid-configuration",
    "allowedAudience": ["your-client-id"],
    "allowedClients": ["your-client-id"]
  }' \
  --region us-east-1

The Payment Manager status starts as CREATING and transitions to READY when provisioning completes.

Coinbase — Quick create (recommended):

With Quick create, you create the connector with an empty credential-provider-configurations list and --provision-mode QUICK_CREATE. You do not create a credential provider first.

aws bedrock-agentcore-control create-payment-connector \
  --payment-manager-id <paymentManagerId> \
  --name "CoinbaseConnector" \
  --type CoinbaseCDP \
  --credential-provider-configurations '[]' \
  --provision-mode QUICK_CREATE \
  --region us-east-1

The response has status PENDING_AUTHENTICATION and an authorizationUrl. Open the URL, authorize through Coinbase, and then poll get-payment-connector until the status is READY. The URL is valid for about 10 minutes; if it expires, the connector transitions to AUTHENTICATION_EXPIRED and you re-create it.

Manual flow: With the manual flow, you create a payment credential provider and then reference its ARN when you create the connector. This is the only flow for Stripe (Privy).

After the Payment Manager is ready, create a payment credential provider:

The following example creates a payment credential provider for Coinbase CDP:

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "coinbase-provider" \
  --credential-provider-vendor CoinbaseCDP \
  --provider-configuration-input '{
    "coinbaseCdpConfiguration": {
      "apiKeyId": "your-coinbase-api-key-id",
      "apiKeySecret": "your-coinbase-api-key-secret",
      "walletSecret": "your-coinbase-wallet-secret"
    }
  }' \
  --region us-east-1

The following example creates a payment credential provider for Stripe Privy:

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "stripe-privy-provider" \
  --credential-provider-vendor StripePrivy \
  --provider-configuration-input '{
    "stripePrivyConfiguration": {
      "appId": "your-stripe-privy-app-id",
      "appSecret": "your-stripe-privy-app-secret",
      "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
      "authorizationId": "your-stripe-privy-authorization-id"
    }
  }' \
  --region us-east-1

After the credential provider is ready, create a connector:

aws bedrock-agentcore-control create-payment-connector \
  --payment-manager-id <paymentManagerId> \
  --name "CoinbaseConnector" \
  --type CoinbaseCDP \
  --credential-provider-configurations '[{
    "coinbaseCDP": {
      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/default/paymentcredentialprovider/my-cdp-provider"
    }
  }]' \
  --region us-east-1

Create a Payment Manager with IAM authorization:

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

# Create PaymentManager with IAM authorization
payment_manager = client.create_payment_manager(
    name="MyPaymentManager",
    authorizerType="AWS_IAM",
    roleArn="arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole"
)

print(f"Payment Manager ID: {payment_manager['paymentManagerId']}")

Create a Payment Manager with JWT authorization:

payment_manager = client.create_payment_manager(
    name="MyPaymentManager",
    authorizerType="CUSTOM_JWT",
    roleArn="arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole",
    customJWTAuthorizerConfiguration={
        "discoveryUrl": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_EXAMPLE/.well-known/openid-configuration",
        "allowedAudience": ["your-client-id"],
        "allowedClients": ["your-client-id"],
        "allowedScopes": ["payments:write"],
        "customClaims": [
            {
                "claimName": "tenant_id",
                "claimValue": "your-unique-tenant-id",
                "operation": "EQUALS"
            }
        ]
    }
)

Coinbase — Quick create (recommended):

With Quick create, you create the connector with an empty credentialProviderConfigurations list and provisionMode="QUICK_CREATE". You do not create a credential provider first.

# Create a Coinbase connector with Quick create
connector = client.create_payment_connector(
    paymentManagerId=payment_manager["paymentManagerId"],
    name="CoinbaseConnector",
    type="CoinbaseCDP",
    credentialProviderConfigurations=[],
    provisionMode="QUICK_CREATE"
)

print(f"Status: {connector['status']}")
print(f"Authorization URL: {connector.get('authorizationUrl')}")

The connector returns status PENDING_AUTHENTICATION and an authorizationUrl. Open the URL, authorize through Coinbase, and then poll get_payment_connector until the status is READY. The URL is valid for about 10 minutes; if it expires, the connector transitions to AUTHENTICATION_EXPIRED and you re-create it.

Manual flow: With the manual flow, you create a payment credential provider and then reference its ARN when you create the connector. This is the only flow for Stripe (Privy).

After the Payment Manager reaches READY status, create a payment credential provider:

The following example configures a provider for Coinbase CDP:

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

coinbase_provider = client.create_payment_credential_provider(
    name="coinbase-provider",
    credentialProviderVendor="CoinbaseCDP",
    providerConfigurationInput={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecret": "your-coinbase-api-key-secret",
            "walletSecret": "your-coinbase-wallet-secret"
        }
    }
)

The following example configures a provider for Stripe Privy:

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

stripe_privy_provider = client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credentialProviderVendor="StripePrivy",
    providerConfigurationInput={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecret": "your-stripe-privy-app-secret",
            "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)

After creating payment credential provider, create a connector:

# Create PaymentConnector for Coinbase CDP
payment_connector = client.create_payment_connector(
    paymentManagerId=payment_manager["paymentManagerId"],
    name="CoinbaseConnector",
    type="CoinbaseCDP",
    credentialProviderConfigurations=[
        {
            "coinbaseCDP": {
                "credentialProviderArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/default/paymentcredentialprovider/my-cdp-provider"
            }
        }
    ]
)

print(f"Connector ID: {payment_connector['paymentConnectorId']}")

For Stripe (Privy), use the stripePrivy configuration variant:

# Create PaymentConnector for Stripe (Privy)
payment_connector = client.create_payment_connector(
    paymentManagerId=payment_manager["paymentManagerId"],
    name="StripePrivyConnector",
    type="StripePrivy",
    credentialProviderConfigurations=[
        {
            "stripePrivy": {
                "credentialProviderArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/default/paymentcredentialprovider/my-privy-provider"
            }
        }
    ]
)

agentcore status

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")
response = payment_client.get_payment_manager(
    payment_manager_id="<paymentManagerId>"
)
print(f"Status: {response['status']}")

aws bedrock-agentcore-control get-payment-manager \
  --payment-manager-id <paymentManagerId> \
  --region us-east-1

response = client.get_payment_manager(
    paymentManagerId="<paymentManagerId>"
)
print(f"Status: {response['status']}")

agentcore status

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")
response = payment_client.list_payment_managers()
for pm in response['paymentManagers']:
    print(f"{pm['name']} - {pm['status']}")

aws bedrock-agentcore-control list-payment-managers \
  --region us-east-1

response = client.list_payment_managers()
for pm in response['paymentManagers']:
    print(f"{pm['name']} - {pm['status']}")

agentcore remove payment-connector --manager MyPaymentManager --name CoinbaseConnector --yes
agentcore remove payment-manager --name MyPaymentManager --yes
agentcore deploy

The remove commands update local configuration. The follow-up deploy tears down the payment infrastructure in your account.

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")
payment_client.delete_payment_manager(
    payment_manager_id="<paymentManagerId>"
)

aws bedrock-agentcore-control delete-payment-manager \
  --payment-manager-id <paymentManagerId> \
  --region us-east-1

client.delete_payment_manager(
    paymentManagerId="<paymentManagerId>"
)