创建支付管理器和连接器

第 1 步：打开 “付款” 页面

第 2 步：配置付款管理器详细信息

第 3 步：配置权限

权限部分指定了该付款管理器的权限以及付款人可以访问的 AWS 资源。

对于 IAM 权限，请选择以下选项之一：

第 4 步：配置入站授权

入站授权控制谁可以访问此付款管理器。在 “入站身份验证” 部分中，对于入站身份验证类型，选择以下选项之一：

要使用 IAM 授权：

要在亚马逊 Cognito 中使用 JWT 授权：

要对现有身份提供商使用 JWT 授权，请执行以下操作：

第 5 步：添加支付连接器（可选）

支付连接器存储与支付服务提供商连接所需的凭证和配置。在创建期间添加连接器是可选的，但服务需要连接器才能处理付款。

创建付款身份验证

当您在连接器的付款身份验证部分选择创建新付款身份验证时，将打开创建付款身份验证面板。在此面板中，您可以配置新的支付身份验证——存储在 Identity 中的 AgentCore 支付凭证提供商。

如果您选择 Coinbase，请选择如何提供付款身份验证凭证：

使用快速创建

如果您选择 “快速创建配置-推荐”， AgentCore 则在您通过Coinbase授权访问权限后，付款会为您创建付款身份验证。完成以下步骤：

使用现有配置

如果您选择 “使用现有配置”，请填写付款提供商配置下的以下字段，然后选择创建付款身份验证：

如果您选择 Stripe（Privy），请填写支付服务提供商配置下的以下字段，然后选择创建付款身份验证：

第 6 步：创建付款管理器

在您选择创建付款管理器后，控制台将导航到付款管理器详细信息页面。成功横幅确认付款管理器已创建，并提供以下后续步骤：

支付管理器详细信息页面包括支付连接器、集成代码模板、入站身份验证、可观察性指标以及日志交付和跟踪配置部分。

AgentCore CLI 会从您的项目目录中同时创建凭证提供商、支付管理器和支付连接器。需要 CLI v0.19.0 或更高版本。

交互式向导：

agentcore add payment-manager

该向导会提示输入经理姓名、模式、自动付款开关、支出限额，并有选择地逐步添加具有提供商凭据的连接器。

Coinbase — 快速创建（推荐）：

快速创建会为您配置 Coinbase 凭据提供商，因此您无需传递任何 API 密钥。添加带有--provision-mode QUICK_CREATE标志的连接器，然后部署：

agentcore add payment-connector \
  --manager MyPaymentManager \
  --name CoinbaseConnector \
  --provider CoinbaseCDP \
  --provision-mode QUICK_CREATE

agentcore deploy

CLI 打开 Coinbase 授权流程。在您授权后，服务会提供证书，连接器就会到达READY。

Coinbase CDP — 手动流程（非交互式）：

agentcore add payment-manager \
  --name MyPaymentManager \
  --auto-payment \
  --default-spend-limit 10.00

agentcore add payment-connector \
  --manager MyPaymentManager \
  --name CoinbaseConnector \
  --provider CoinbaseCDP \
  --api-key-id <YOUR_API_KEY_ID> \
  --api-key-secret <YOUR_API_KEY_SECRET> \
  --wallet-secret <YOUR_WALLET_SECRET>

agentcore deploy

Stripe（Privy）— 手动流程（非交互式）：

agentcore add payment-manager \
  --name MyPaymentManager \
  --auto-payment \
  --default-spend-limit 10.00

agentcore add payment-connector \
  --manager MyPaymentManager \
  --name StripePrivyConnector \
  --provider StripePrivy \
  --app-id <YOUR_APP_ID> \
  --app-secret <YOUR_APP_SECRET> \
  --authorization-id <YOUR_AUTHORIZATION_ID> \
  --authorization-private-key <YOUR_PRIVATE_KEY_BASE64>

agentcore deploy

运行预agentcore deploy置 IAM 角色，在 I AgentCore dentity 中存储证书，并创建支付管理器和连接器。

该 AgentCore 软件开发工具包支持Coinbase 快速创建（如图所示）和手动配置。遵循提供商证书的手册示例直接传递了提供商证书。他们使用便捷方法create_payment_manager_with_connector，在一次调用中即可创建支付管理器、凭证提供商和连接器。

Coinbase — 快速创建（推荐）：

使用 “快速创建”，您可以使用空credential_provider_configurations列表创建连接器，然后provision_mode="QUICK_CREATE"。连接器返回状态PENDING_AUTHENTICATION和授权 URL。在您通过 Coinbase 进行授权后，凭证提供商和连接器将到达该服务。READY

import time
import webbrowser

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

connector = payment_client.create_payment_connector(
    payment_manager_id="<paymentManagerId>",
    name="CoinbaseConnector",
    connector_type="CoinbaseCDP",
    credential_provider_configurations=[],
    provision_mode="QUICK_CREATE",
)

# Authorize through Coinbase using the returned URL.
webbrowser.open(connector["authorizationUrl"])

# Terminal states that mean provisioning did not succeed.
TERMINAL_FAILURES = {
    "AUTHENTICATION_EXPIRED",
    "AUTHENTICATION_FAILED",
    "AWS_MARKETPLACE_SUBSCRIPTION_REQUIRED",
    "CREATE_FAILED",
}

# Poll until the connector reaches READY or fails.
while True:
    response = payment_client.get_payment_connector(
        payment_connector_id=connector["paymentConnectorId"]
    )
    status = response["status"]
    if status == "READY":
        break
    if status in TERMINAL_FAILURES:
        raise RuntimeError(f"Connector provisioning failed: {status}")
    time.sleep(5)

授权 URL 的有效期约为 10 分钟。如果它过期，则连接器会转换到，AUTHENTICATION_EXPIRED然后您重新创建它。

具有 IAM 授权的 Coinbase CDP：

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="MyPaymentManager",
    payment_manager_description="Payment manager for my agent.",
    authorizer_type="AWS_IAM",
    role_arn="arn:aws:iam::123456789012:role/MyPaymentRole",
    payment_connector_config={
        "name": "CoinbaseConnector",
        "description": "Coinbase CDP connector",
        "payment_credential_provider_config": {
            "name": "MyCoinbaseProvider",
            "credential_provider_vendor": "CoinbaseCDP",
            "credentials": {
                "api_key_id": "your-api-key-id",
                "api_key_secret": "your-api-key-secret",
                "wallet_secret": "your-wallet-secret",
            },
        },
    },
    wait_for_ready=True,
    max_wait=300,
    poll_interval=5,
)

payment_manager = response.get("paymentManager", {})
payment_connector = response.get("paymentConnector", {})
credential_provider = response.get("credentialProvider", {})

payment_manager_arn = payment_manager.get("paymentManagerArn")
payment_connector_id = payment_connector.get("paymentConnectorId")

print(f"Payment Manager ARN: {payment_manager_arn}")
print(f"Connector ID: {payment_connector_id}")

具有 JWT 授权的 Coinbase CDP：

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="CoinbasePaymentManagerJWT",
    payment_manager_description="Coinbase Payment Manager (JWT auth)",
    authorizer_type="CUSTOM_JWT",
    role_arn="arn:aws:iam::123456789012:role/BedrockAgentCoreFullAccess",
    payment_connector_config={
        "name": "coinbase-connector-jwt",
        "description": "Coinbase Connector (JWT)",
        "payment_credential_provider_config": {
            "name": "my-coinbase-provider-jwt",
            "credential_provider_vendor": "CoinbaseCDP",
            "credentials": {
                "api_key_id": "your-api-key-id",
                "api_key_secret": "your-api-key-secret",
                "wallet_secret": "your-wallet-secret",
            },
        },
    },
    wait_for_ready=True,
)

manager_arn = response["paymentManager"]["paymentManagerArn"]
connector_id = response["paymentConnector"]["paymentConnectorId"]
provider_arn = response["credentialProvider"]["credentialProviderArn"]

具有 IAM 授权的 Stripe (Privy)：

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="StripePaymentManager",
    payment_manager_description="Stripe + Privy Payment Manager (IAM auth)",
    authorizer_type="AWS_IAM",
    role_arn="arn:aws:iam::123456789012:role/BedrockAgentCoreFullAccess",
    payment_connector_config={
        "name": "stripe-privy-connector",
        "description": "Stripe + Privy Connector",
        "payment_credential_provider_config": {
            "name": "my-stripe-privy-provider",
            "credential_provider_vendor": "StripePrivy",
            "credentials": {
                "app_id": "your-privy-app-id",
                "app_secret": "your-privy-app-secret",
                "authorization_private_key": "your-authorization-private-key",
                "authorization_id": "your-authorization-id",
            },
        },
    },
    wait_for_ready=True,
)

manager_arn = response["paymentManager"]["paymentManagerArn"]
connector_id = response["paymentConnector"]["paymentConnectorId"]
provider_arn = response["credentialProvider"]["credentialProviderArn"]

获得 JWT 授权的 Stripe（Privy）：

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="StripePaymentManagerJWT",
    payment_manager_description="Stripe + Privy Payment Manager (JWT auth)",
    authorizer_type="CUSTOM_JWT",
    role_arn="arn:aws:iam::123456789012:role/BedrockAgentCoreFullAccess",
    payment_connector_config={
        "name": "stripe-privy-connector-jwt",
        "description": "Stripe + Privy Connector (JWT)",
        "payment_credential_provider_config": {
            "name": "my-stripe-privy-provider-jwt",
            "credential_provider_vendor": "StripePrivy",
            "credentials": {
                "app_id": "your-privy-app-id",
                "app_secret": "your-privy-app-secret",
                "authorization_private_key": "your-authorization-private-key",
                "authorization_id": "your-authorization-id",
            },
        },
    },
    wait_for_ready=True,
)

manager_arn = response["paymentManager"]["paymentManagerArn"]
connector_id = response["paymentConnector"]["paymentConnectorId"]
provider_arn = response["credentialProvider"]["credentialProviderArn"]

使用 IAM 授权创建付款经理：

aws bedrock-agentcore-control create-payment-manager \
  --name "MyPaymentManager" \
  --authorizer-type AWS_IAM \
  --role-arn "arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole" \
  --region us-east-1

使用 JWT 授权创建付款管理器：

aws bedrock-agentcore-control create-payment-manager \
  --name "MyPaymentManager" \
  --authorizer-type CUSTOM_JWT \
  --role-arn "arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole" \
  --custom-jwt-authorizer-configuration '{
    "discoveryUrl": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_EXAMPLE/.well-known/openid-configuration",
    "allowedAudience": ["your-client-id"],
    "allowedClients": ["your-client-id"]
  }' \
  --region us-east-1

付款管理器状态开始为，CREATING并在预付完成READY时过渡到。

Coinbase — 快速创建（推荐）：

使用快速创建，您可以使用空的凭证提供商配置列表来创建连接器，然后. --provision-mode QUICK_CREATE 您不要先创建凭证提供商。

aws bedrock-agentcore-control create-payment-connector \
  --payment-manager-id <paymentManagerId> \
  --name "CoinbaseConnector" \
  --type CoinbaseCDP \
  --credential-provider-configurations '[]' \
  --provision-mode QUICK_CREATE \
  --region us-east-1

响应具有状态PENDING_AUTHENTICATION和authorizationUrl. 打开网址，通过Coinbase进行授权，然后进行轮询get-payment-connector直到状态为READY。该 URL 的有效期约为 10 分钟；如果过期，则连接器会转换到，AUTHENTICATION_EXPIRED然后您重新创建它。

手动流程：使用手动流程，您可以创建支付凭证提供商，然后在创建连接器时引用其 ARN。这是 Stripe（Privy）的唯一流程。

付款管理器准备就绪后，创建付款凭证提供商：

以下示例为 Coinbase CDP 创建了支付凭证提供商：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "coinbase-provider" \
  --credential-provider-vendor CoinbaseCDP \
  --provider-configuration-input '{
    "coinbaseCdpConfiguration": {
      "apiKeyId": "your-coinbase-api-key-id",
      "apiKeySecret": "your-coinbase-api-key-secret",
      "walletSecret": "your-coinbase-wallet-secret"
    }
  }' \
  --region us-east-1

以下示例为 Stripe Privy 创建了支付凭证提供商：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "stripe-privy-provider" \
  --credential-provider-vendor StripePrivy \
  --provider-configuration-input '{
    "stripePrivyConfiguration": {
      "appId": "your-stripe-privy-app-id",
      "appSecret": "your-stripe-privy-app-secret",
      "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
      "authorizationId": "your-stripe-privy-authorization-id"
    }
  }' \
  --region us-east-1

在凭证提供者准备就绪后，创建一个连接器：

aws bedrock-agentcore-control create-payment-connector \
  --payment-manager-id <paymentManagerId> \
  --name "CoinbaseConnector" \
  --type CoinbaseCDP \
  --credential-provider-configurations '[{
    "coinbaseCDP": {
      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/default/paymentcredentialprovider/my-cdp-provider"
    }
  }]' \
  --region us-east-1

使用 IAM 授权创建付款经理：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

# Create PaymentManager with IAM authorization
payment_manager = client.create_payment_manager(
    name="MyPaymentManager",
    authorizerType="AWS_IAM",
    roleArn="arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole"
)

print(f"Payment Manager ID: {payment_manager['paymentManagerId']}")

使用 JWT 授权创建付款管理器：

payment_manager = client.create_payment_manager(
    name="MyPaymentManager",
    authorizerType="CUSTOM_JWT",
    roleArn="arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole",
    customJWTAuthorizerConfiguration={
        "discoveryUrl": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_EXAMPLE/.well-known/openid-configuration",
        "allowedAudience": ["your-client-id"],
        "allowedClients": ["your-client-id"],
        "allowedScopes": ["payments:write"],
        "customClaims": [
            {
                "claimName": "tenant_id",
                "claimValue": "your-unique-tenant-id",
                "operation": "EQUALS"
            }
        ]
    }
)

Coinbase — 快速创建（推荐）：

使用 “快速创建”，您可以使用空credentialProviderConfigurations列表创建连接器，然后provisionMode="QUICK_CREATE"。您不要先创建凭证提供商。

# Create a Coinbase connector with Quick create
connector = client.create_payment_connector(
    paymentManagerId=payment_manager["paymentManagerId"],
    name="CoinbaseConnector",
    type="CoinbaseCDP",
    credentialProviderConfigurations=[],
    provisionMode="QUICK_CREATE"
)

print(f"Status: {connector['status']}")
print(f"Authorization URL: {connector.get('authorizationUrl')}")

连接器返回状态PENDING_AUTHENTICATION和authorizationUrl. 打开网址，通过Coinbase进行授权，然后进行轮询get_payment_connector直到状态为READY。该 URL 的有效期约为 10 分钟；如果过期，则连接器会转换到，AUTHENTICATION_EXPIRED然后您重新创建它。

手动流程：使用手动流程，您可以创建支付凭证提供商，然后在创建连接器时引用其 ARN。这是 Stripe（Privy）的唯一流程。

付款管理器达到READY状态后，创建付款凭证提供商：

以下示例为 Coinbase CDP 配置了提供商：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

coinbase_provider = client.create_payment_credential_provider(
    name="coinbase-provider",
    credentialProviderVendor="CoinbaseCDP",
    providerConfigurationInput={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecret": "your-coinbase-api-key-secret",
            "walletSecret": "your-coinbase-wallet-secret"
        }
    }
)

以下示例为 Stripe Privy 配置了提供商：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

stripe_privy_provider = client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credentialProviderVendor="StripePrivy",
    providerConfigurationInput={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecret": "your-stripe-privy-app-secret",
            "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)

创建支付凭证提供商后，创建连接器：

# Create PaymentConnector for Coinbase CDP
payment_connector = client.create_payment_connector(
    paymentManagerId=payment_manager["paymentManagerId"],
    name="CoinbaseConnector",
    type="CoinbaseCDP",
    credentialProviderConfigurations=[
        {
            "coinbaseCDP": {
                "credentialProviderArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/default/paymentcredentialprovider/my-cdp-provider"
            }
        }
    ]
)

print(f"Connector ID: {payment_connector['paymentConnectorId']}")

对于 Stripe (Privy)，使用stripePrivy配置变体：

# Create PaymentConnector for Stripe (Privy)
payment_connector = client.create_payment_connector(
    paymentManagerId=payment_manager["paymentManagerId"],
    name="StripePrivyConnector",
    type="StripePrivy",
    credentialProviderConfigurations=[
        {
            "stripePrivy": {
                "credentialProviderArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/default/paymentcredentialprovider/my-privy-provider"
            }
        }
    ]
)

agentcore status

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")
response = payment_client.get_payment_manager(
    payment_manager_id="<paymentManagerId>"
)
print(f"Status: {response['status']}")

aws bedrock-agentcore-control get-payment-manager \
  --payment-manager-id <paymentManagerId> \
  --region us-east-1

response = client.get_payment_manager(
    paymentManagerId="<paymentManagerId>"
)
print(f"Status: {response['status']}")

agentcore status

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")
response = payment_client.list_payment_managers()
for pm in response['paymentManagers']:
    print(f"{pm['name']} - {pm['status']}")

aws bedrock-agentcore-control list-payment-managers \
  --region us-east-1

response = client.list_payment_managers()
for pm in response['paymentManagers']:
    print(f"{pm['name']} - {pm['status']}")

agentcore remove payment-connector --manager MyPaymentManager --name CoinbaseConnector --yes
agentcore remove payment-manager --name MyPaymentManager --yes
agentcore deploy

这些remove命令更新本地配置。后续行动deploy破坏了您账户中的支付基础设施。

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")
payment_client.delete_payment_manager(
    payment_manager_id="<paymentManagerId>"
)

aws bedrock-agentcore-control delete-payment-manager \
  --payment-manager-id <paymentManagerId> \
  --region us-east-1

client.delete_payment_manager(
    paymentManagerId="<paymentManagerId>"
)