KDCube
← AI Industry News

Agents Get a Wallet and a Badge: Payments and Identity Go GA

Amazon Bedrock AgentCore Payments and Okta Agent SSO both reached general availability, giving production agents a managed way to pay for APIs and tools and a first-class identity with short-lived tokens. Together they close the two gaps that gated unattended agents — how they transact and how they prove who they are —...

Highlights

  • Amazon Bedrock AgentCore Payments hit general availability, letting agents autonomously discover and pay for APIs, MCP tools, and paid content with infrastructure-level spend limits and x402/MPP protocol support (AWS).
  • Okta Agent SSO reached GA, registering AI agents as first-class identities in Universal Directory and swapping hardcoded credentials for scoped, short-lived tokens — at no extra cost on core SSO plans (Okta).
  • The two shipments close the last gaps for unattended production agents: how they pay and how they prove who they are — the governance layer prior issues flagged as the real adoption wall (AWS).
  • Payments integrates Coinbase and Stripe Privy wallets for microtransactions and ships a curated Coinbase Bazar MCP server with pay-per-use endpoints (The Paypers).
  • Payagent commerce
  • IDagent identity
  • MCPtools
  • Govbudget · policy

Key Signals

  1. AWS · Aug 18 2026

    AgentCore Payments goes GA — agents can now transact without a human in the loop

    AWS moved its Payments service (preview since spring) to general availability, giving agents a managed path to autonomously pay for APIs, MCPs, and content. Guardrails are enforced at the infrastructure layer — configurable payment limits, end-to-end AgentCore Observability, and support for the x402 "upto" scheme and Machine Payment Protocol for dynamic pricing. Builders can point Claude Code, Kiro, or Codex at the skill to scaffold a payment-enabled agent from credential setup to first transaction (AWS, The Paypers).

  2. Okta · Aug 24 2026

    Okta ships Agent SSO to GA — first-class identity for agents

    Okta made Agent SSO generally available, registering agents in Universal Directory alongside employees and issuing short-lived, identity-governed tokens when an agent acts in another app on a user's behalf. It also discovers shadow agents and assigns each a named human owner. Wider runtime oversight remains a separate product, Okta for AI Agents (Okta, TechNode).

  3. Aug 2026

    Money plus identity reframes the risk surface

    Once agents hold spend authority and a durable identity, the operational question shifts from "what can this agent read?" to "what did this identity authorize, and for how much?" — pushing signed task authorizations, per-identity budgets, and tamper-evident logs from nice-to-have to table stakes (AWS).

Why It Matters / What To Watch

  1. Autonomous spend needs budget controls before scale, not after
    • Wire AgentCore Payments limits and Observability to the identity, not just the agent process, so overspend is attributable and capped per owner (AWS).
    • Watch how x402/MPP dynamic-pricing "upto" schemes interact with hard limits when a paid endpoint quotes a variable price mid-run (AWS).
  2. Short-lived tokens raise the bar on agent inventory
    • Use Agent SSO's shadow-agent discovery to close the gap between agents that exist and agents that are governed — unregistered agents still fall outside policy (Okta).
    • Confirm token scope actually narrows blast radius: bind each token to the specific app and task, and expire it fast (TechNode).

Quick Links