An agentic system can research, reason, and orchestrate multi-step workflows, but the moment it hits a paywall, it stops. It has no wallet, no card, and no spending limit. t54 solved that problem. Amazon Bedrock AgentCore is a platform to build, connect, and optimize agents at scale, with any framework or model. Their trust layer on Amazon Bedrock AgentCore payments, a capability of Amazon Bedrock AgentCore, has processed over 20 million agent-initiated transactions without a human approving a single one. Each transaction is a micropayment between $0.001 and $0.01: fast, high-volume calls that no human could review at that rate.
The problem: Giving an agent a wallet is straightforward, but governing it at scale is not
t54’s customers deploy agentic systems that need to pay for third-party services autonomously. Consider a financial services team running an agentic system that monitors stock portfolios and alerts analysts when positions shift. The system needs real-time market data from a paid API. Giving the agent access to a wallet is straightforward. The hard part is everything around it: enforcing spending limits so a single misconfigured loop cannot drain an account, isolating credentials so the agent never touches raw keys, auditing every transaction for compliance, and doing all of this across dozens of agents calling hundreds of endpoints.
Without that governance layer, the team faces a choice: review and approve every transaction manually, or accept unmanaged risk. At low volumes, manual approval works. At machine speed, with thousands of API calls per hour, it breaks down. The team needs autonomous payments with built-in controls.
t54 builds trust infrastructure for agent payments. Their customers kept asking for the same thing: a way to let agents pay that was secure, scalable, and provider-agnostic, without building custom payment orchestration from scratch. To deliver that, t54 needed a payments backbone with session-scoped spending limits, credential vaulting, and multi-provider support baked in.
Amazon Bedrock AgentCore payments provides the spending infrastructure: session limits, credential isolation, and payment execution. t54’s x402-secure provides the trust intelligence: real-time endpoint scoring that determines who is safe to pay. Together, they give teams governed agent payments without custom integration work.
What t54 built
t54 builds the trust infrastructure that governs which services AI agents can safely pay. Their product, x402-secure, is a trust layer that scores endpoints and on-chain payment addresses in real time. Before an agent pays a service, x402-secure tells it whether that service is safe to pay.
The protocol underneath is x402, an open payment standard that uses the HTTP 402 status code to let clients pay for APIs directly over HTTP. When an agent calls a paid endpoint and receives a 402 response, Amazon Bedrock AgentCore payments handles the signing and settlement. The agent does not handle private keys directly.
Trustline, the scoring engine behind x402-secure, evaluates five independent signals before a payment settles. Those signals are: the blockchain history of the payment address, the legitimacy of the destination webpage, the service’s social media footprint, the API’s live health status, and an aggregate risk score synthesized from all four. Each signal catches a different class of untrusted endpoint. t54 designed their risk model so that no single weak signal can authorize a transaction on its own.
The product suite also includes ClawCredit, an agent-native credit facility. Amazon Bedrock AgentCore payments enforces the per-session spending ceiling, while ClawCredit provides the credit-backed funding source that operates within it. Both layers govern spending independently.
“There are already a lot of strong developers on AgentCore, and we felt the best experience was to serve them right there, with Trustline built into the platform, instead of making them wire up their own payment orchestration. What developers really worry about is an agent doing something with real financial consequences. Our job is to give them peace of mind.”
— Chandler Fang, founder of t54
Architecture: How trust and payment work together
Figure 1: Trust-gated x402 payment flow, where the trust check must pass before Amazon Bedrock AgentCore payments settles a transaction
This diagram shows the end-to-end flow across five lanes: the application backend, Amazon Bedrock AgentCore runtime (a capability of Amazon Bedrock AgentCore), the Strands agent with its deterministic trust gate, external paid services, and Amazon Bedrock AgentCore payments. A trust check must pass before a payment can proceed. For the full Amazon Bedrock AgentCore payments architecture, including AWS Identity and Access Management (IAM) authentication, AWS Secrets Manager credential storage, and Amazon CloudWatch observability, see Technical deep dive: AgentCore Payments and innovation in agentic commerce.
The core design principle is a separation of duties. The thing that spends money should never be the thing that sets spending rules. t54 enforces this through strict role separation with IAM. They split the system across four roles so that the agent runtime can execute payments but cannot change its own limits, provision new wallets, or access credentials directly.
In practice, this means the agent receives a session ID and an instrument ID at invocation time, nothing else. Developer credentials are encrypted in AWS Secrets Manager through Amazon Bedrock AgentCore Identity, a capability of Amazon Bedrock AgentCore, and not returned from APIs. End-user wallet signing keys stay with the wallet provider (Coinbase). The agent receives only a session-scoped token. If the agent exhausts its spending limit, it stops. There is no path to refill or recreate the session from inside the agent.
“The hardest call was making the risk check a mandatory gate before every ProcessPayment, not something running on the side. Scoring each endpoint inline costs a little latency, but the alternative lets payments settle before we’ve checked who’s on the other end. For agents moving real money, that’s not a trade we’ll make. So we accept a little added latency for one guarantee: nothing settles without a fresh risk decision.”
— Frank He, PhD, who led the integration at t54
The trust gate: Why it matters
That guarantee Frank describes is the key architectural choice. The trust check is a deterministic gate, not a model-prompted suggestion. The agentic system calls the x402-secure API before each payment. If the endpoint fails to clear the score threshold, is flagged as a scam, or has a URL mismatch, the payment is blocked in code. The model cannot override it.
At scale, agents calling unknown APIs without pre-payment authorization create unmanaged risk. The deterministic trust gate closes that surface.
In production, that design held.
Demo: x402-secure in action
This video demonstrates the end-to-end flow. An agentic system discovers a paid endpoint. x402-secure scores it in real time through Trustline. Amazon Bedrock AgentCore payments then executes the transaction within the session spending limit.
Results
Since launch, x402-secure has processed more than 20 million AI-agent-initiated transactions. The deterministic trust gate, IAM role separation, and session spending limits keep every transaction governed without requiring a human in the loop.
“Twenty million transactions tells us agent-to-agent payments are already happening at real scale, not just in a demo. Each one is a micropayment between $0.001 and $0.01, the kind of fast, small call for data or an API that no person could review in real time. Along the way we’ve blocked payments to endpoints that scored as high-risk, so the session keeps its spending limit and the agent gets routed somewhere safer.”
— Chandler Fang, founder of t54
The financial primitives for autonomous AI are already in production. The harder question is not whether agents will need to pay for things. It is whether the governance layer is in place before something settles that should not.
Under the hood: Control plane and data plane
For builders who want to implement a similar integration, here is how t54 mapped their system to the two layers of Amazon Bedrock AgentCore payments.
Setting up (control plane)
Three resources create payment infrastructure without custom integration code per provider:
- Credential Provider stores credentials in a token vault. Credentials do not appear in plain text to the agent runtime.
- Payment Manager ties together authorization, identity, and payment connectors. t54 configured it with a
CUSTOM_JWTauthorizer backed by an OpenID Connect (OIDC) discovery endpoint. - Payment Connector specifies the payment provider type (
CoinbaseCDP) and references the Credential Provider, linking the Payment Manager to the external provider.
At runtime (data plane)
Three operations handle live transactions:
CreatePaymentSessionopens a session with a spending limit, an expiry window (15 to 480 minutes), and auserId. Amazon Bedrock AgentCore payments tracks the available spend in real time.CreatePaymentInstrumentprovisions an Embedded Crypto Wallet with a specified network. The response returns a wallet address and a redirect URL for onboarding.ProcessPaymentexecutes the payment. Before it settles, Trustline scores the endpoint. When approved, Amazon Bedrock AgentCore payments returns aprocessPaymentId, status, and full audit trail. If flagged, x402-secure blocks the payment and keeps the spending limit intact.
MCP marketplace integration
t54 also tested the same integration against the Coinbase x402 Bazaar, a marketplace of paid AI tool servers (Model Context Protocol, or MCP, servers). The agentic system connects through Amazon Bedrock AgentCore Gateway, a capability of Amazon Bedrock AgentCore, discovers paid tools, and calls them. When a tool returns an x402 payment requirement, ProcessPayment signs the transaction. One Amazon Bedrock AgentCore payments setup covers both direct API endpoints and marketplace-listed tools without additional configuration.
The trust signals
Table 1 lists the x402-secure endpoints available for scoring before payment.
| Endpoint | What it checks |
POST /x402/tools/get_overall_score |
Comprehensive security score with risk indicators |
POST /x402/tools/get_onchain_trust |
Blockchain address risk detection |
POST /x402/tools/get_webpage_trust |
AI-powered phishing and unauthorized activity detection |
POST /x402/tools/get_social_trust |
Social media reputation scoring |
POST /x402/tools/get_api_health |
Server reliability and compliance |
POST /x402/tools/evaluate_agent_payment |
Pre-transaction payment risk evaluation (Base) |
Table 1: x402-secure trust-scoring endpoints
Observability and audit
Every ProcessPayment call emits structured logs (session, instrument, amount, status) to Amazon CloudWatch. AWS CloudTrail captures the full API history for compliance review. Trust decisions and payment outcomes are correlated in Amazon CloudWatch Application Signals on a per-session basis. For regulated workloads, this gives compliance teams a continuous audit trail of every dollar an agent spends and the trust signal it spent against.
Get started
If you are building agents that hit paid APIs:
The t54 x402-secure use case shows the full implementation described in this post. The Getting Started Tutorial walks through your first agentic payment end-to-end. Add trust-scored payments to an existing AgentCore agent with the open-source SDK:
If you are an API provider offering paid endpoints:
Replace your x402 facilitator URL with the t54 proxy to add trust protection. Same x402 API, one configuration change:
Learn more
- Read the launch blog, Agents that transact: Introducing Amazon Bedrock AgentCore payments, for the service architecture and partner network.
- Amazon Bedrock AgentCore payments Getting Started Tutorial for a step-by-step walkthrough of your first agentic payment.
- Explore the Amazon Bedrock AgentCore payments Use Cases for reference implementations of common payment patterns.
- Refer to the Amazon Bedrock AgentCore payments documentation for the full API reference and configuration guide.
- Visit the Amazon Bedrock AgentCore page for a service overview and pricing.
- Install the x402-secure SDK, which is open source under the MIT license.
- View the x402-secure dashboard for real-time risk intelligence.
- Learn more about Trustline and ClawCredit at t54.ai.