AgentCore Payments: Pay-Per-Inference Authorization Over x402

AWS AgentCore Payments enables agents to pay each other for inference requests without human intervention. This service uses the x402 protocol, a standard for HTTP-level micropayments, and ties spending limits to agent identity. Both BlockRun and Incarna have implemented this in production, with Incarna's agents paying BlockRun for each inference request.

The x402 protocol adds payment headers to HTTP requests, which are validated before processing the inference. This payment happens inline with the request, eliminating the need for a separate settlement step or asynchronous reconciliation.

The spending limit functions as both a budget control and an authorization boundary. Payment tokens are scoped to agent identity and workflow context, expiring after a single use or short TTL (typically 60 seconds). Validation occurs at the edge, before the request reaches application logic, with failed payments returning HTTP 402 (Payment Required) along with the remaining balance.

Spending limits add a financial dimension to traditional API authorization, creating three enforcement layers: identity, permission, and budget. When an agent hits its spending limit mid-workflow, the next inference request fails fast with a 402 response, requiring the agent to handle this explicitly.

Each agent receives a unique payment credential tied to its identity, with automatic rotation when agents restart. Multi-tenant deployments have isolated spending limits per tenant. BlockRun, a provider of model inference as a service, previously built custom payment logic for each client, requiring months of development. With AgentCore Payments, BlockRun integrated x402 validation into their API gateway, implementing it as middleware rather than application logic.

This integration took days instead of months due to its middleware nature, managed spending limits, automatic credential rotation, and built-in observability hooks.

AgentCore Payments exposes spending metrics through CloudWatch, generating events with agent identity, service called, amount charged, remaining balance, timestamp, and workflow context. Monitoring patterns include alerting when an agent drains 80% of its limit in under 10 minutes, tracking spending velocity per agent, comparing expected vs. actual costs per workflow type, and identifying unusual service calls.

Anomaly detection can auto-suspend an agent's payment credentials if it starts calling expensive services or making an unusual number of requests.

Failure modes and edge cases include hitting the spending limit mid-workflow, resulting in a 402 response requiring explicit handling or failure. Payment token expiration leads to a 401 response, necessitating credential refresh and retry. Network partitions during validation cause timeouts, with no charge incurred. Agents retry with the same token, utilizing its idempotent nature.

Service overcharges trigger alerts and can pause the service if discrepancies between expected and actual charges occur. Multi-agent workflows involve a payment chain where each hop validates payment independently. If an agent runs out of budget, it returns a 402 to the previous agent, which must decide whether to increase the limit or fail the workflow.

AgentCore Payments is a managed service in the AWS control plane, requiring only configuration rather than deployment. Setup involves creating a spending limit policy, attaching it to agent identity, and enabling AgentCore Payments.