建立付款管理員和連接器

步驟 1：開啟付款頁面

步驟 2：設定 Payment Manager 詳細資訊

步驟 3：設定許可

許可區段會指定此付款管理員的許可，以及付款可存取 AWS 的資源。

針對 IAM 許可，選擇下列其中一個選項：

步驟 4：設定傳入授權

傳入授權控制誰可以存取此 Payment Manager。在傳入身分驗證區段中，針對傳入身分驗證類型，選擇下列其中一個選項：

若要使用 IAM 授權：

若要搭配 Amazon Cognito 使用 JWT 授權：

若要搭配現有的身分提供者使用 JWT 授權：

步驟 5：新增付款連接器 （選用）

付款連接器會存放與付款服務供應商連線所需的登入資料和組態。在建立期間新增連接器是選用的，但服務需要連接器才能處理付款。

建立付款驗證

當您選擇在連接器的付款驗證區段中建立新的付款驗證，則會開啟建立付款驗證面板。在此面板中，您會設定新的付款身分驗證  ：存放在 AgentCore Identity 中的付款憑證提供者。

如果您選擇 Coinbase，請選擇如何提供付款驗證的憑證：

使用快速建立

如果您選取快速建立組態 - 建議，AgentCore 付款會在您透過 Coinbase 授權存取後為您建立付款驗證。請完成下列步驟：

使用現有的組態

如果您選取使用現有組態，請完成付款提供者組態下的下列欄位，然後選擇建立付款驗證：

如果您選擇條紋 （私有），請完成付款供應商組態下的下列欄位，然後選擇建立付款驗證：

步驟 6：建立付款管理員

選擇建立付款管理員後，主控台會導覽至付款管理員詳細資訊頁面。成功橫幅會確認已建立 Payment Manager，並提供下列後續步驟：

Payment Manager 詳細資訊頁面包含付款連接器、整合程式碼範本、傳入驗證、可觀測性指標，以及日誌傳遞和追蹤組態的區段。

AgentCore CLI 會從您的專案目錄中同時建立登入資料提供者、Payment Manager 和 Payment Connector。需要 CLI v0.19.0 或更新版本。

互動式精靈：

agentcore add payment-manager

精靈會提示管理員名稱、模式、自動付款切換、花費限制，以及選擇性演練新增連接器與供應商登入資料。

Coinbase — 快速建立 （建議）：

快速建立會為您佈建 Coinbase 登入資料提供者，因此您不會傳遞任何 API 金鑰。使用 --provision-mode QUICK_CREATE旗標新增連接器，然後部署：

agentcore add payment-connector \
  --manager MyPaymentManager \
  --name CoinbaseConnector \
  --provider CoinbaseCDP \
  --provision-mode QUICK_CREATE

agentcore deploy

CLI 會開啟 Coinbase 授權流程。在您授權之後，服務會佈建登入資料，而連接器會達到 READY。

Coinbase CDP — 手動流程 （非互動式）：

agentcore add payment-manager \
  --name MyPaymentManager \
  --auto-payment \
  --default-spend-limit 10.00

agentcore add payment-connector \
  --manager MyPaymentManager \
  --name CoinbaseConnector \
  --provider CoinbaseCDP \
  --api-key-id <YOUR_API_KEY_ID> \
  --api-key-secret <YOUR_API_KEY_SECRET> \
  --wallet-secret <YOUR_WALLET_SECRET>

agentcore deploy

條紋 （私有） — 手動流程 （非互動式）：

agentcore add payment-manager \
  --name MyPaymentManager \
  --auto-payment \
  --default-spend-limit 10.00

agentcore add payment-connector \
  --manager MyPaymentManager \
  --name StripePrivyConnector \
  --provider StripePrivy \
  --app-id <YOUR_APP_ID> \
  --app-secret <YOUR_APP_SECRET> \
  --authorization-id <YOUR_AUTHORIZATION_ID> \
  --authorization-private-key <YOUR_PRIVATE_KEY_BASE64>

agentcore deploy

執行 會agentcore deploy佈建 IAM 角色、將登入資料存放在 AgentCore Identity 中，並建立 Payment Manager 和 Connector。

AgentCore SDK 支援 Coinbase Quick create （首先顯示） 和手動佈建。直接遵循傳遞提供者憑證的手動範例。它們使用便利方法 create_payment_manager_with_connector，可在單一呼叫中建立 Payment Manager、登入資料提供者和連接器。

Coinbase — 快速建立 （建議）：

使用快速建立，您可以建立具有空白credential_provider_configurations清單 和 的連接器provision_mode="QUICK_CREATE"。連接器會傳回狀態PENDING_AUTHENTICATION和授權 URL。透過 Coinbase 授權之後，服務會佈建登入資料提供者，而連接器會達到 READY。

import time
import webbrowser

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

connector = payment_client.create_payment_connector(
    payment_manager_id="<paymentManagerId>",
    name="CoinbaseConnector",
    connector_type="CoinbaseCDP",
    credential_provider_configurations=[],
    provision_mode="QUICK_CREATE",
)

# Authorize through Coinbase using the returned URL.
webbrowser.open(connector["authorizationUrl"])

# Terminal states that mean provisioning did not succeed.
TERMINAL_FAILURES = {
    "AUTHENTICATION_EXPIRED",
    "AUTHENTICATION_FAILED",
    "AWS_MARKETPLACE_SUBSCRIPTION_REQUIRED",
    "CREATE_FAILED",
}

# Poll until the connector reaches READY or fails.
while True:
    response = payment_client.get_payment_connector(
        payment_connector_id=connector["paymentConnectorId"]
    )
    status = response["status"]
    if status == "READY":
        break
    if status in TERMINAL_FAILURES:
        raise RuntimeError(f"Connector provisioning failed: {status}")
    time.sleep(5)

授權 URL 的有效期約為 10 分鐘。如果過期，連接器會轉換為 AUTHENTICATION_EXPIRED，然後您重新建立它。

Coinbase CDP 搭配 IAM 授權：

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="MyPaymentManager",
    payment_manager_description="Payment manager for my agent.",
    authorizer_type="AWS_IAM",
    role_arn="arn:aws:iam::123456789012:role/MyPaymentRole",
    payment_connector_config={
        "name": "CoinbaseConnector",
        "description": "Coinbase CDP connector",
        "payment_credential_provider_config": {
            "name": "MyCoinbaseProvider",
            "credential_provider_vendor": "CoinbaseCDP",
            "credentials": {
                "api_key_id": "your-api-key-id",
                "api_key_secret": "your-api-key-secret",
                "wallet_secret": "your-wallet-secret",
            },
        },
    },
    wait_for_ready=True,
    max_wait=300,
    poll_interval=5,
)

payment_manager = response.get("paymentManager", {})
payment_connector = response.get("paymentConnector", {})
credential_provider = response.get("credentialProvider", {})

payment_manager_arn = payment_manager.get("paymentManagerArn")
payment_connector_id = payment_connector.get("paymentConnectorId")

print(f"Payment Manager ARN: {payment_manager_arn}")
print(f"Connector ID: {payment_connector_id}")

Coinbase CDP 搭配 JWT 授權：

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="CoinbasePaymentManagerJWT",
    payment_manager_description="Coinbase Payment Manager (JWT auth)",
    authorizer_type="CUSTOM_JWT",
    role_arn="arn:aws:iam::123456789012:role/BedrockAgentCoreFullAccess",
    payment_connector_config={
        "name": "coinbase-connector-jwt",
        "description": "Coinbase Connector (JWT)",
        "payment_credential_provider_config": {
            "name": "my-coinbase-provider-jwt",
            "credential_provider_vendor": "CoinbaseCDP",
            "credentials": {
                "api_key_id": "your-api-key-id",
                "api_key_secret": "your-api-key-secret",
                "wallet_secret": "your-wallet-secret",
            },
        },
    },
    wait_for_ready=True,
)

manager_arn = response["paymentManager"]["paymentManagerArn"]
connector_id = response["paymentConnector"]["paymentConnectorId"]
provider_arn = response["credentialProvider"]["credentialProviderArn"]

具有 IAM 授權的 Stripe (Privy)：

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="StripePaymentManager",
    payment_manager_description="Stripe + Privy Payment Manager (IAM auth)",
    authorizer_type="AWS_IAM",
    role_arn="arn:aws:iam::123456789012:role/BedrockAgentCoreFullAccess",
    payment_connector_config={
        "name": "stripe-privy-connector",
        "description": "Stripe + Privy Connector",
        "payment_credential_provider_config": {
            "name": "my-stripe-privy-provider",
            "credential_provider_vendor": "StripePrivy",
            "credentials": {
                "app_id": "your-privy-app-id",
                "app_secret": "your-privy-app-secret",
                "authorization_private_key": "your-authorization-private-key",
                "authorization_id": "your-authorization-id",
            },
        },
    },
    wait_for_ready=True,
)

manager_arn = response["paymentManager"]["paymentManagerArn"]
connector_id = response["paymentConnector"]["paymentConnectorId"]
provider_arn = response["credentialProvider"]["credentialProviderArn"]

具有 JWT 授權的條紋 （私有）：

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="StripePaymentManagerJWT",
    payment_manager_description="Stripe + Privy Payment Manager (JWT auth)",
    authorizer_type="CUSTOM_JWT",
    role_arn="arn:aws:iam::123456789012:role/BedrockAgentCoreFullAccess",
    payment_connector_config={
        "name": "stripe-privy-connector-jwt",
        "description": "Stripe + Privy Connector (JWT)",
        "payment_credential_provider_config": {
            "name": "my-stripe-privy-provider-jwt",
            "credential_provider_vendor": "StripePrivy",
            "credentials": {
                "app_id": "your-privy-app-id",
                "app_secret": "your-privy-app-secret",
                "authorization_private_key": "your-authorization-private-key",
                "authorization_id": "your-authorization-id",
            },
        },
    },
    wait_for_ready=True,
)

manager_arn = response["paymentManager"]["paymentManagerArn"]
connector_id = response["paymentConnector"]["paymentConnectorId"]
provider_arn = response["credentialProvider"]["credentialProviderArn"]

使用 IAM 授權建立 Payment Manager：

aws bedrock-agentcore-control create-payment-manager \
  --name "MyPaymentManager" \
  --authorizer-type AWS_IAM \
  --role-arn "arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole" \
  --region us-east-1

使用 JWT 授權建立付款管理員：

aws bedrock-agentcore-control create-payment-manager \
  --name "MyPaymentManager" \
  --authorizer-type CUSTOM_JWT \
  --role-arn "arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole" \
  --custom-jwt-authorizer-configuration '{
    "discoveryUrl": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_EXAMPLE/.well-known/openid-configuration",
    "allowedAudience": ["your-client-id"],
    "allowedClients": ["your-client-id"]
  }' \
  --region us-east-1

Payment Manager 狀態會開始為 ，CREATING並在佈建完成READY時轉換為 。

Coinbase — 快速建立 （建議）：

使用快速建立，您可以使用空白的 credential-provider-configurations 清單 和 來建立連接器--provision-mode QUICK_CREATE。您不會先建立登入資料提供者。

aws bedrock-agentcore-control create-payment-connector \
  --payment-manager-id <paymentManagerId> \
  --name "CoinbaseConnector" \
  --type CoinbaseCDP \
  --credential-provider-configurations '[]' \
  --provision-mode QUICK_CREATE \
  --region us-east-1

回應具有狀態 PENDING_AUTHENTICATION和 authorizationUrl。開啟 URL，透過 Coinbase 授權，然後輪詢get-payment-connector直到狀態為 READY。URL 的有效期約為 10 分鐘；如果過期，連接器會轉換為 AUTHENTICATION_EXPIRED，然後您重新建立它。

手動流程：使用手動流程，您可以建立付款憑證提供者，然後在建立連接器時參考其 ARN。這是 Stripe (Privy) 的唯一流程。

在 Payment Manager 就緒後，建立付款憑證提供者：

下列範例會建立 Coinbase CDP 的付款憑證提供者：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "coinbase-provider" \
  --credential-provider-vendor CoinbaseCDP \
  --provider-configuration-input '{
    "coinbaseCdpConfiguration": {
      "apiKeyId": "your-coinbase-api-key-id",
      "apiKeySecret": "your-coinbase-api-key-secret",
      "walletSecret": "your-coinbase-wallet-secret"
    }
  }' \
  --region us-east-1

下列範例會建立 Stripe Privy 的付款憑證提供者：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "stripe-privy-provider" \
  --credential-provider-vendor StripePrivy \
  --provider-configuration-input '{
    "stripePrivyConfiguration": {
      "appId": "your-stripe-privy-app-id",
      "appSecret": "your-stripe-privy-app-secret",
      "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
      "authorizationId": "your-stripe-privy-authorization-id"
    }
  }' \
  --region us-east-1

登入資料提供者準備就緒後，請建立連接器：

aws bedrock-agentcore-control create-payment-connector \
  --payment-manager-id <paymentManagerId> \
  --name "CoinbaseConnector" \
  --type CoinbaseCDP \
  --credential-provider-configurations '[{
    "coinbaseCDP": {
      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/default/paymentcredentialprovider/my-cdp-provider"
    }
  }]' \
  --region us-east-1

使用 IAM 授權建立 Payment Manager：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

# Create PaymentManager with IAM authorization
payment_manager = client.create_payment_manager(
    name="MyPaymentManager",
    authorizerType="AWS_IAM",
    roleArn="arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole"
)

print(f"Payment Manager ID: {payment_manager['paymentManagerId']}")

使用 JWT 授權建立付款管理員：

payment_manager = client.create_payment_manager(
    name="MyPaymentManager",
    authorizerType="CUSTOM_JWT",
    roleArn="arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole",
    customJWTAuthorizerConfiguration={
        "discoveryUrl": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_EXAMPLE/.well-known/openid-configuration",
        "allowedAudience": ["your-client-id"],
        "allowedClients": ["your-client-id"],
        "allowedScopes": ["payments:write"],
        "customClaims": [
            {
                "claimName": "tenant_id",
                "claimValue": "your-unique-tenant-id",
                "operation": "EQUALS"
            }
        ]
    }
)

Coinbase — 快速建立 （建議）：

使用快速建立，您可以建立具有空白credentialProviderConfigurations清單 和 的連接器provisionMode="QUICK_CREATE"。您不會先建立登入資料提供者。

# Create a Coinbase connector with Quick create
connector = client.create_payment_connector(
    paymentManagerId=payment_manager["paymentManagerId"],
    name="CoinbaseConnector",
    type="CoinbaseCDP",
    credentialProviderConfigurations=[],
    provisionMode="QUICK_CREATE"
)

print(f"Status: {connector['status']}")
print(f"Authorization URL: {connector.get('authorizationUrl')}")

連接器會傳回狀態PENDING_AUTHENTICATION和 authorizationUrl。開啟 URL，透過 Coinbase 授權，然後輪詢get_payment_connector直到狀態為 READY。URL 的有效期約為 10 分鐘；如果過期，連接器會轉換為 AUTHENTICATION_EXPIRED，然後您重新建立它。

手動流程：使用手動流程，您可以建立付款憑證提供者，然後在建立連接器時參考其 ARN。這是 Stripe (Privy) 的唯一流程。

在 Payment Manager 達到 READY 狀態後，建立付款憑證提供者：

下列範例會設定 Coinbase CDP 的提供者：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

coinbase_provider = client.create_payment_credential_provider(
    name="coinbase-provider",
    credentialProviderVendor="CoinbaseCDP",
    providerConfigurationInput={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecret": "your-coinbase-api-key-secret",
            "walletSecret": "your-coinbase-wallet-secret"
        }
    }
)

下列範例會設定 Stripe Privy 的提供者：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

stripe_privy_provider = client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credentialProviderVendor="StripePrivy",
    providerConfigurationInput={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecret": "your-stripe-privy-app-secret",
            "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)

建立付款憑證提供者之後，請建立連接器：

# Create PaymentConnector for Coinbase CDP
payment_connector = client.create_payment_connector(
    paymentManagerId=payment_manager["paymentManagerId"],
    name="CoinbaseConnector",
    type="CoinbaseCDP",
    credentialProviderConfigurations=[
        {
            "coinbaseCDP": {
                "credentialProviderArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/default/paymentcredentialprovider/my-cdp-provider"
            }
        }
    ]
)

print(f"Connector ID: {payment_connector['paymentConnectorId']}")

對於 Stripe (Privy)，請使用stripePrivy組態變體：

# Create PaymentConnector for Stripe (Privy)
payment_connector = client.create_payment_connector(
    paymentManagerId=payment_manager["paymentManagerId"],
    name="StripePrivyConnector",
    type="StripePrivy",
    credentialProviderConfigurations=[
        {
            "stripePrivy": {
                "credentialProviderArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/default/paymentcredentialprovider/my-privy-provider"
            }
        }
    ]
)

agentcore status

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")
response = payment_client.get_payment_manager(
    payment_manager_id="<paymentManagerId>"
)
print(f"Status: {response['status']}")

aws bedrock-agentcore-control get-payment-manager \
  --payment-manager-id <paymentManagerId> \
  --region us-east-1

response = client.get_payment_manager(
    paymentManagerId="<paymentManagerId>"
)
print(f"Status: {response['status']}")

agentcore status

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")
response = payment_client.list_payment_managers()
for pm in response['paymentManagers']:
    print(f"{pm['name']} - {pm['status']}")

aws bedrock-agentcore-control list-payment-managers \
  --region us-east-1

response = client.list_payment_managers()
for pm in response['paymentManagers']:
    print(f"{pm['name']} - {pm['status']}")

agentcore remove payment-connector --manager MyPaymentManager --name CoinbaseConnector --yes
agentcore remove payment-manager --name MyPaymentManager --yes
agentcore deploy

remove 命令會更新本機組態。追蹤deploy會縮減您帳戶中的付款基礎設施。

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")
payment_client.delete_payment_manager(
    payment_manager_id="<paymentManagerId>"
)

aws bedrock-agentcore-control delete-payment-manager \
  --payment-manager-id <paymentManagerId> \
  --region us-east-1

client.delete_payment_manager(
    paymentManagerId="<paymentManagerId>"
)