创建付款管理器和连接器

第 1 步：打开 “付款” 页面

第 2 步：配置付款管理器详细信息

步骤 3：配置权限

权限部分指定了此付款管理器的权限以及付款可以访问的 Amazon 资源。

对于 IAM 权限，请选择以下选项之一：

步骤 4：配置入站授权

入站授权控制谁可以访问此付款管理器。在入站身份验证部分中，对于入站身份验证类型，选择以下选项之一：

要使用 IAM 授权：

要在 Amazon Cognito 上使用 JWT 授权，请执行以下操作：

要对现有身份提供商使用 JWT 授权，请执行以下操作：

第 5 步：添加支付连接器（可选）

支付连接器存储与支付服务提供商连接所需的凭据和配置。在创建期间添加连接器是可选的，但是服务需要连接器才能处理付款。

创建付款身份验证

当您在连接器的 “付款身份验证” 部分中选择创建新的付款身份验证时，将打开 “创建付款身份验证” 面板。在此面板中，您可以配置新的支付身份验证，即存储在 Identity 中的 AgentCore 支付凭证提供商。

如果您选择 Coinbase，请选择如何为支付身份验证提供凭据：

使用快速创建

如果您选择快速创建配置（推荐），则在您通过 Coinbase 授权访问权限后，P AgentCore ayments 会为您创建付款身份验证。完成以下步骤：

由于 Quick create 会为您配置证书，因此它们是服务管理的，您可以随时替换它们，而无需在 Coinbase 中生成密钥。有关更多信息，请参阅轮换服务管理的连接器凭据。

使用现有配置

如果您选择使用现有配置，请填写支付服务提供商配置下的以下字段，然后选择创建付款身份验证：

如果您选择 Stripe (Privy)，请在 “支付提供商配置” 下填写以下字段，然后选择 “创建付款身份验证”：

第 6 步：创建付款管理器

选择创建付款管理器后，控制台将导航至付款管理器详细信息页面。成功横幅确认付款管理器已创建，并提供以下后续步骤：

付款管理器详细信息页面包括付款连接器、集成代码模板、入站身份验证、可观察性指标以及日志交付和跟踪配置等部分。

AgentCore CLI 从您的项目目录中同时创建凭证提供商、付款管理器和支付连接器。需要 CLI 版本 0.19.0 或更高版本。

交互式向导：

agentcore add payment-manager

向导会提示您输入经理姓名、模式、自动付款切换、支出限制，并可选择性地介绍如何添加带有提供商凭据的连接器。

Coinbase — 快速创建（推荐）：

快速创建会为您配置 Coinbase 凭证提供商，因此您无需传递任何 API 密钥。添加带有--provision-mode QUICK_CREATE标志的连接器，然后部署：

agentcore add payment-connector \
  --manager MyPaymentManager \
  --name CoinbaseConnector \
  --provider CoinbaseCDP \
  --provision-mode QUICK_CREATE

agentcore deploy

CLI 会打开 Coinbase 授权流程。在您授权后，服务会配置凭证，连接器就会到达READY。

Coinbase CDP — 手动流程（非交互式）：

agentcore add payment-manager \
  --name MyPaymentManager \
  --auto-payment \
  --default-spend-limit 10.00

agentcore add payment-connector \
  --manager MyPaymentManager \
  --name CoinbaseConnector \
  --provider CoinbaseCDP \
  --api-key-id <YOUR_API_KEY_ID> \
  --api-key-secret <YOUR_API_KEY_SECRET> \
  --wallet-secret <YOUR_WALLET_SECRET>

agentcore deploy

Stripe（Privy）— 手动流程（非交互式）：

agentcore add payment-manager \
  --name MyPaymentManager \
  --auto-payment \
  --default-spend-limit 10.00

agentcore add payment-connector \
  --manager MyPaymentManager \
  --name StripePrivyConnector \
  --provider StripePrivy \
  --app-id <YOUR_APP_ID> \
  --app-secret <YOUR_APP_SECRET> \
  --authorization-id <YOUR_AUTHORIZATION_ID> \
  --authorization-private-key <YOUR_PRIVATE_KEY_BASE64>

agentcore deploy

运行配置 agentcore deploy IAM 角色，在 Ident AgentCore ity 中存储证书，并创建支付管理器和连接器。

该 AgentCore 软件开发工具包支持 Coinbase 快速创建（如图所示）和手动配置。随后的手册示例直接传递提供商证书。他们使用便捷方法create_payment_manager_with_connector，只需一次调用即可创建付款管理器、凭证提供商和连接器。

Coinbase — 快速创建（推荐）：

使用 “快速创建”，您可以使用空credential_provider_configurations列表创建连接器，然后provision_mode="QUICK_CREATE"。连接器返回状态PENDING_AUTHENTICATION和授权 URL。在您通过 Coinbase 授权后，该服务会提供证书提供商和连接器到达。READY

import time
import webbrowser

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

connector = payment_client.create_payment_connector(
    payment_manager_id="<paymentManagerId>",
    name="CoinbaseConnector",
    connector_type="CoinbaseCDP",
    credential_provider_configurations=[],
    provision_mode="QUICK_CREATE",
)

# Authorize through Coinbase using the returned URL.
webbrowser.open(connector["authorizationUrl"])

# Terminal states that mean provisioning did not succeed.
TERMINAL_FAILURES = {
    "AUTHENTICATION_EXPIRED",
    "AUTHENTICATION_FAILED",
    "AWS_MARKETPLACE_SUBSCRIPTION_REQUIRED",
    "CREATE_FAILED",
}

# Poll until the connector reaches READY or fails.
while True:
    response = payment_client.get_payment_connector(
        payment_connector_id=connector["paymentConnectorId"]
    )
    status = response["status"]
    if status == "READY":
        break
    if status in TERMINAL_FAILURES:
        raise RuntimeError(f"Connector provisioning failed: {status}")
    time.sleep(5)

授权网址的有效期约为 10 分钟。如果连接器过期，则连接器会过渡到，AUTHENTICATION_EXPIRED然后您重新创建它。

获得 IAM 授权的 Coinbase CDP：

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="MyPaymentManager",
    payment_manager_description="Payment manager for my agent.",
    authorizer_type="AWS_IAM",
    role_arn="arn:aws:iam::123456789012:role/MyPaymentRole",
    payment_connector_config={
        "name": "CoinbaseConnector",
        "description": "Coinbase CDP connector",
        "payment_credential_provider_config": {
            "name": "MyCoinbaseProvider",
            "credential_provider_vendor": "CoinbaseCDP",
            "credentials": {
                "api_key_id": "your-api-key-id",
                "api_key_secret": "your-api-key-secret",
                "wallet_secret": "your-wallet-secret",
            },
        },
    },
    wait_for_ready=True,
    max_wait=300,
    poll_interval=5,
)

payment_manager = response.get("paymentManager", {})
payment_connector = response.get("paymentConnector", {})
credential_provider = response.get("credentialProvider", {})

payment_manager_arn = payment_manager.get("paymentManagerArn")
payment_connector_id = payment_connector.get("paymentConnectorId")

print(f"Payment Manager ARN: {payment_manager_arn}")
print(f"Connector ID: {payment_connector_id}")

获得智威汤逊授权的 Coinbase CDP：

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="CoinbasePaymentManagerJWT",
    payment_manager_description="Coinbase Payment Manager (JWT auth)",
    authorizer_type="CUSTOM_JWT",
    role_arn="arn:aws:iam::123456789012:role/BedrockAgentCoreFullAccess",
    payment_connector_config={
        "name": "coinbase-connector-jwt",
        "description": "Coinbase Connector (JWT)",
        "payment_credential_provider_config": {
            "name": "my-coinbase-provider-jwt",
            "credential_provider_vendor": "CoinbaseCDP",
            "credentials": {
                "api_key_id": "your-api-key-id",
                "api_key_secret": "your-api-key-secret",
                "wallet_secret": "your-wallet-secret",
            },
        },
    },
    wait_for_ready=True,
)

manager_arn = response["paymentManager"]["paymentManagerArn"]
connector_id = response["paymentConnector"]["paymentConnectorId"]
provider_arn = response["credentialProvider"]["credentialProviderArn"]

获得 IAM 授权的 Stripe（Privy）：

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="StripePaymentManager",
    payment_manager_description="Stripe + Privy Payment Manager (IAM auth)",
    authorizer_type="AWS_IAM",
    role_arn="arn:aws:iam::123456789012:role/BedrockAgentCoreFullAccess",
    payment_connector_config={
        "name": "stripe-privy-connector",
        "description": "Stripe + Privy Connector",
        "payment_credential_provider_config": {
            "name": "my-stripe-privy-provider",
            "credential_provider_vendor": "StripePrivy",
            "credentials": {
                "app_id": "your-privy-app-id",
                "app_secret": "your-privy-app-secret",
                "authorization_private_key": "your-authorization-private-key",
                "authorization_id": "your-authorization-id",
            },
        },
    },
    wait_for_ready=True,
)

manager_arn = response["paymentManager"]["paymentManagerArn"]
connector_id = response["paymentConnector"]["paymentConnectorId"]
provider_arn = response["credentialProvider"]["credentialProviderArn"]

获得 JWT 授权的 Stripe（Privy）：

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")

response = payment_client.create_payment_manager_with_connector(
    payment_manager_name="StripePaymentManagerJWT",
    payment_manager_description="Stripe + Privy Payment Manager (JWT auth)",
    authorizer_type="CUSTOM_JWT",
    role_arn="arn:aws:iam::123456789012:role/BedrockAgentCoreFullAccess",
    payment_connector_config={
        "name": "stripe-privy-connector-jwt",
        "description": "Stripe + Privy Connector (JWT)",
        "payment_credential_provider_config": {
            "name": "my-stripe-privy-provider-jwt",
            "credential_provider_vendor": "StripePrivy",
            "credentials": {
                "app_id": "your-privy-app-id",
                "app_secret": "your-privy-app-secret",
                "authorization_private_key": "your-authorization-private-key",
                "authorization_id": "your-authorization-id",
            },
        },
    },
    wait_for_ready=True,
)

manager_arn = response["paymentManager"]["paymentManagerArn"]
connector_id = response["paymentConnector"]["paymentConnectorId"]
provider_arn = response["credentialProvider"]["credentialProviderArn"]

创建具有 IAM 授权的支付管理器：

aws bedrock-agentcore-control create-payment-manager \
  --name "MyPaymentManager" \
  --authorizer-type AWS_IAM \
  --role-arn "arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole" \
  --region us-east-1

创建具有 JWT 授权的支付管理器：

aws bedrock-agentcore-control create-payment-manager \
  --name "MyPaymentManager" \
  --authorizer-type CUSTOM_JWT \
  --role-arn "arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole" \
  --custom-jwt-authorizer-configuration '{
    "discoveryUrl": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_EXAMPLE/.well-known/openid-configuration",
    "allowedAudience": ["your-client-id"],
    "allowedClients": ["your-client-id"]
  }' \
  --region us-east-1

付款管理器状态从配置完成时开始，CREATING然后过渡到配置完成READY时。

Coinbase — 快速创建（推荐）：

使用 Quick create，您可以使用空的凭据提供者配置列表创建连接器，然后。--provision-mode QUICK_CREATE您无需先创建凭证提供商。

aws bedrock-agentcore-control create-payment-connector \
  --payment-manager-id <paymentManagerId> \
  --name "CoinbaseConnector" \
  --type CoinbaseCDP \
  --credential-provider-configurations '[]' \
  --provision-mode QUICK_CREATE \
  --region us-east-1

响应具有状态PENDING_AUTHENTICATION和authorizationUrl。打开网址，通过 Coinbase 进行授权，然后进行民意调查，get-payment-connector直到状态为READY。该 URL 的有效期约为 10 分钟；如果过期，连接器会过渡到，AUTHENTICATION_EXPIRED然后您重新创建它。

Quick create 提供的凭据是服务管理的，因此您可以根据需要将其替换为。rotate-payment-connector-credentials有关更多信息，请参阅轮换服务管理的连接器凭据。

手动流程：使用手动流程，您可以创建付款凭证提供商，然后在创建连接器时引用其 ARN。这是 Stripe（Privy）的唯一流程。

付款管理器准备就绪后，创建付款凭证提供商：

以下示例为 Coinbase CDP 创建了一个支付凭证提供商：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "coinbase-provider" \
  --credential-provider-vendor CoinbaseCDP \
  --provider-configuration-input '{
    "coinbaseCdpConfiguration": {
      "apiKeyId": "your-coinbase-api-key-id",
      "apiKeySecret": "your-coinbase-api-key-secret",
      "walletSecret": "your-coinbase-wallet-secret"
    }
  }' \
  --region us-east-1

以下示例为 Stripe Privy 创建了一个支付凭证提供商：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "stripe-privy-provider" \
  --credential-provider-vendor StripePrivy \
  --provider-configuration-input '{
    "stripePrivyConfiguration": {
      "appId": "your-stripe-privy-app-id",
      "appSecret": "your-stripe-privy-app-secret",
      "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
      "authorizationId": "your-stripe-privy-authorization-id"
    }
  }' \
  --region us-east-1

证书提供商准备就绪后，创建一个连接器：

aws bedrock-agentcore-control create-payment-connector \
  --payment-manager-id <paymentManagerId> \
  --name "CoinbaseConnector" \
  --type CoinbaseCDP \
  --credential-provider-configurations '[{
    "coinbaseCDP": {
      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/default/paymentcredentialprovider/my-cdp-provider"
    }
  }]' \
  --region us-east-1

创建具有 IAM 授权的支付管理器：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

# Create PaymentManager with IAM authorization
payment_manager = client.create_payment_manager(
    name="MyPaymentManager",
    authorizerType="AWS_IAM",
    roleArn="arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole"
)

print(f"Payment Manager ID: {payment_manager['paymentManagerId']}")

创建具有 JWT 授权的支付管理器：

payment_manager = client.create_payment_manager(
    name="MyPaymentManager",
    authorizerType="CUSTOM_JWT",
    roleArn="arn:aws:iam::123456789012:role/AgentCorePaymentsResourceRetrievalRole",
    customJWTAuthorizerConfiguration={
        "discoveryUrl": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_EXAMPLE/.well-known/openid-configuration",
        "allowedAudience": ["your-client-id"],
        "allowedClients": ["your-client-id"],
        "allowedScopes": ["payments:write"],
        "customClaims": [
            {
                "claimName": "tenant_id",
                "claimValue": "your-unique-tenant-id",
                "operation": "EQUALS"
            }
        ]
    }
)

Coinbase — 快速创建（推荐）：

使用 “快速创建”，您可以使用空credentialProviderConfigurations列表创建连接器，然后provisionMode="QUICK_CREATE"。您无需先创建凭证提供商。

# Create a Coinbase connector with Quick create
connector = client.create_payment_connector(
    paymentManagerId=payment_manager["paymentManagerId"],
    name="CoinbaseConnector",
    type="CoinbaseCDP",
    credentialProviderConfigurations=[],
    provisionMode="QUICK_CREATE"
)

print(f"Status: {connector['status']}")
print(f"Authorization URL: {connector.get('authorizationUrl')}")

连接器返回状态PENDING_AUTHENTICATION和authorizationUrl. 打开网址，通过 Coinbase 进行授权，然后进行民意调查，get_payment_connector直到状态为READY。该 URL 的有效期约为 10 分钟；如果过期，连接器会过渡到，AUTHENTICATION_EXPIRED然后您重新创建它。

Quick create 提供的凭据是服务管理的，因此您可以根据需要将其替换为。rotate_payment_connector_credentials有关更多信息，请参阅轮换服务管理的连接器凭据。

手动流程：使用手动流程，您可以创建付款凭证提供商，然后在创建连接器时引用其 ARN。这是 Stripe（Privy）的唯一流程。

付款管理器进入READY状态后，创建付款凭证提供商：

以下示例为 Coinbase CDP 配置了一个提供商：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

coinbase_provider = client.create_payment_credential_provider(
    name="coinbase-provider",
    credentialProviderVendor="CoinbaseCDP",
    providerConfigurationInput={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecret": "your-coinbase-api-key-secret",
            "walletSecret": "your-coinbase-wallet-secret"
        }
    }
)

以下示例为 Stripe Privy 配置了提供商：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

stripe_privy_provider = client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credentialProviderVendor="StripePrivy",
    providerConfigurationInput={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecret": "your-stripe-privy-app-secret",
            "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)

创建付款凭证提供商后，创建连接器：

# Create PaymentConnector for Coinbase CDP
payment_connector = client.create_payment_connector(
    paymentManagerId=payment_manager["paymentManagerId"],
    name="CoinbaseConnector",
    type="CoinbaseCDP",
    credentialProviderConfigurations=[
        {
            "coinbaseCDP": {
                "credentialProviderArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/default/paymentcredentialprovider/my-cdp-provider"
            }
        }
    ]
)

print(f"Connector ID: {payment_connector['paymentConnectorId']}")

对于 Stripe（Privy），请使用stripePrivy配置变体：

# Create PaymentConnector for Stripe (Privy)
payment_connector = client.create_payment_connector(
    paymentManagerId=payment_manager["paymentManagerId"],
    name="StripePrivyConnector",
    type="StripePrivy",
    credentialProviderConfigurations=[
        {
            "stripePrivy": {
                "credentialProviderArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/default/paymentcredentialprovider/my-privy-provider"
            }
        }
    ]
)

agentcore status

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")
response = payment_client.get_payment_manager(
    payment_manager_id="<paymentManagerId>"
)
print(f"Status: {response['status']}")

aws bedrock-agentcore-control get-payment-manager \
  --payment-manager-id <paymentManagerId> \
  --region us-east-1

response = client.get_payment_manager(
    paymentManagerId="<paymentManagerId>"
)
print(f"Status: {response['status']}")

agentcore status

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")
response = payment_client.list_payment_managers()
for pm in response['paymentManagers']:
    print(f"{pm['name']} - {pm['status']}")

aws bedrock-agentcore-control list-payment-managers \
  --region us-east-1

response = client.list_payment_managers()
for pm in response['paymentManagers']:
    print(f"{pm['name']} - {pm['status']}")

agentcore remove payment-connector --manager MyPaymentManager --name CoinbaseConnector --yes
agentcore remove payment-manager --name MyPaymentManager --yes
agentcore deploy

这些remove命令更新本地配置。后续行动deploy会破坏您账户中的支付基础设施。

from bedrock_agentcore.payments.client import PaymentClient

payment_client = PaymentClient(region_name="us-east-1")
payment_client.delete_payment_manager(
    payment_manager_id="<paymentManagerId>"
)

aws bedrock-agentcore-control delete-payment-manager \
  --payment-manager-id <paymentManagerId> \
  --region us-east-1

client.delete_payment_manager(
    paymentManagerId="<paymentManagerId>"
)