Anchor Browser and AgentCore payments let AI agents pay for x402 content

The problem: agents stall at HTTP 402

AWS describes a growing gap in how AI agents work with the web. Premium datasets charge by the query, research APIs meter by the call, and paywalled publishers gate content behind payment. When an agent hits one of these resources, the server returns HTTP 402 Payment Required. According to AWS, the agent has no built-in payment mechanism, no budget attached to the session and no programmatic way to satisfy the request, so the task stalls and needs manual intervention.

The x402 protocol is an open standard for HTTP-based machine-to-machine payments. A server answers with 402 Payment Required along with the amount, accepted payment methods and payment address the agent uses to complete the transaction.

AWS says developers currently have to build the whole payment stack themselves. That covers four areas:

• Payment protocol handling: parsing the 402 challenge, building the payment header with cryptographic proof, and supporting several payment schemes across merchants.
• Security and key management: storing a private key for signing and managing wallet lifecycle tasks such as key rotation.
• Operational resilience: resubmitting the request while preserving session state, ensuring idempotency, and enforcing per-session and per-transaction spend limits.
• Observability and compliance: logging every payment attempt, approval, denial and settlement for audit and reconciliation.

Security risks of keeping payments inside the agent

The post also points to risks beyond engineering effort. Without hard spending limits at the infrastructure level, AWS says, a bug, retry loop, prompt injection or inadvertent access can trigger unintended payments. An agent retrying a paid endpoint in a loop keeps authorizing payments until someone intervenes.

Private keys held inside the agent runtime share an environment with untrusted web pages, third-party tools and external dependencies, which might inadvertently disclose credentials that control real funds. If signing infrastructure is reachable from the runtime, a threat actor could try to get the key or redirect payments to an address under unauthorized control. AWS says effective mitigation requires that the key never enters the runtime. For browser-based agents, the payment must also happen in the same browser session, otherwise session recordings and live view no longer match what was executed.

How the integration works

Anchor Browser is a cloud-based browser automation product built for AI agents. Each session runs in a managed browser environment that keeps authentication state, handles navigation, captures network requests and offers a live view. Anchor agents include a built-in x402 tool for paid API calls inside the browser context, and AWS says it requires no changes to existing Playwright, Puppeteer or Chrome DevTools Protocol workflows.

Amazon Bedrock AgentCore payments is a fully managed capability that lets agents discover, access and pay for APIs, Model Context Protocol (MCP) servers and web content. It manages wallet connectivity, enforces configurable spending limits at the infrastructure layer and processes payments through x402. Payment attempts, approvals, denials and settlements can be observed through Amazon CloudWatch.

The central resource is the Payment Manager, which coordinates payment operations for the AWS account and requires an authorizer type and an IAM role. Three components connect it to wallet infrastructure:

• A PaymentConnector links it to an external wallet provider, either Coinbase Developer Platform (Coinbase CDP) or Stripe Privy.
• A PaymentCredentialProvider stores wallet provider credentials in AgentCore Identity.
• A PaymentInstrument identifies the wallet address from which funds are drawn.

For discovery, AgentCore offers a curated Coinbase x402 Bazaar MCP server through Amazon Bedrock AgentCore Gateway, so agents can find pay-per-use x402 endpoints programmatically. When a session starts with x402 turned on, Anchor Browser creates a dedicated AgentCore PaymentSession that links the browser session to a configured payment instrument.

What it means for developers

In this design the Anchor Agent holds only two payment-related components: a budget session and the x402 tool. Authentication, wallet secrets, payment limits, observability and payment proof signing sit in the AgentCore payments layer. According to AWS, when an agent meets a 402 response, AgentCore payments authorizes and completes the transaction within the configured budget and the workflow continues without interruption.

For teams building agents that touch paid web resources, the pitch is that they no longer need to write and secure their own signing, retry and logging code, and that the recording of a session captures the full sequence from request to 402 to payment to content delivery.