Change
33aeda7
33aeda7f66e2cd006311c30023c0ec93eebc4d2e · commit on GitHub
aws-blog-feed: changed (530164 bytes, HTTP 200)
raw/aws-blog-feed/response.xml modified
- Source
- aws-blog-feed
- Lines added
- +3,274
- Lines removed
- -3,208
- Stored bytes at this commit
- 530,164
- Timestamp
- observed
- Raw artifact at this commit
- raw/aws-blog-feed/response.xml
Recorded headers
| observed_at | 2026-10-14T04:54:22.617Z |
|---|---|
| origin_date | null |
| status | 200 |
| final URL | https://aws.amazon.com/blogs/machine-learning/feed/ |
| etag | null |
| last-modified | Tue, 13 Oct 2026 20:10:49 GMT |
| date | Wed, 14 Oct 2026 04:54:22 GMT |
| age | null |
| cache-control | null |
| cf-cache-status | null |
| content-encoding | null |
| content-length | null |
@
@@ -5,7 +5,7 @@ <atom:link href="https://aws.amazon.com/blogs/machine-learning/feed/" rel="self" type="application/rss+xml"/> <link>https://aws.amazon.com/blogs/machine-learning/</link> <description>Official Machine Learning Blog of Amazon Web Services</description>-
<lastBuildDate>Mon, 12 Oct 2026 17:52:22 +0000</lastBuildDate>+
<lastBuildDate>Tue, 13 Oct 2026 20:10:33 +0000</lastBuildDate> <language>en-US</language> <sy:updatePeriod> hourly </sy:updatePeriod>@
@@ -13,353 +13,492 @@ 1 </sy:updateFrequency> <item>-
<title>Accessing OpenAI GPT models on Amazon Bedrock with global cross-Region inference in Thailand, Malaysia, Singapore, Indonesia, and Taiwan</title>-
<link>https://aws.amazon.com/blogs/machine-learning/accessing-openai-gpt-models-on-amazon-bedrock-with-global-cross-region-inference-in-thailand-malaysia-singapore-indonesia-and-taiwan/</link>+
<title>Building agents that transact with Anchor Browser and AgentCore payments</title>+
<link>https://aws.amazon.com/blogs/machine-learning/building-agents-that-transact-with-anchor-browser-and-agentcore-payments/</link> -
<dc:creator><![CDATA[Traci Lim]]></dc:creator>-
<pubDate>Mon, 12 Oct 2026 17:52:22 +0000</pubDate>-
<category><![CDATA[Advanced (300)]]></category>-
<category><![CDATA[Amazon Bedrock]]></category>-
<category><![CDATA[Technical How-to]]></category>-
<guid isPermaLink="false">e20b8171cff84e878ab96622856dfe3f22a41ff0</guid>+
<dc:creator><![CDATA[Cher Simon]]></dc:creator>+
<pubDate>Tue, 13 Oct 2026 20:10:33 +0000</pubDate>+
<category><![CDATA[Amazon Bedrock AgentCore]]></category>+
<category><![CDATA[Customer Solutions]]></category>+
<category><![CDATA[Intermediate (200)]]></category>+
<guid isPermaLink="false">0c79d3a743bd70e676fa029365ec191931b2b410</guid>-
<description>Learn how to run OpenAI GPT-6 Sol, Luna, and Astra on Amazon Bedrock through global cross-Region inference from Singapore, Jakarta, Thailand, Malaysia, and Taipei. This post covers the Converse and OpenAI-compatible APIs, IAM and SCP permissions, quota sizing, and monitoring infere…-
<content:encoded><p>Single-Region inference can throttle when demand exceeds local capacity. Teams in Thailand, Malaysia, Singapore, Indonesia, and Taiwan need access to the newest OpenAI models beyond that capacity. <a href="https://aws.amazon.com/bedrock/" target="_blank" rel="n…-
<p>GPT-6 Sol, GPT-6 Luna, and GPT-6 Astra are all available through global cross-Region inference from the preceding Regions, on the <code>bedrock-runtime</code> endpoint. See <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference.html" target="_bla…-
<p>In this post, we introduce the global cross-Region inference profiles and invoke them from Asia Pacific (Singapore) using the Converse API, the OpenAI-compatible APIs, and coding clients. We then cover the <a href="https://aws.amazon.com/iam/" target="_blank" rel="noopener">AWS Identi…-
<h2 id="global-cross-region-inference-profiles-for-openai-gpt-6">Global cross-Region inference profiles for OpenAI GPT-6</h2>-
<p>The GPT-6 family offers three models, each available through global cross-Region inference.</p>+
<description>Learn how the AWS Generative AI Innovation Center Partner Agent Factory and Anchor Browser built AI agents that autonomously pay for x402-protected web resources and APIs. Amazon Bedrock AgentCore payments checks budgets, signs transactions, and retries requests without exposing wa…+
<content:encoded><p>AI agents increasingly need to access web resources that are priced per request. For example, premium datasets charge by the query, research APIs meter by the call, and paywalled publishers gate content behind payment. When an AI agent encounters one of these reso…+
<p><a href="https://aws.amazon.com/marketplace/pp/prodview-ujbrqwp274l6g" target="_blank" rel="noopener">Anchor Browser with Agentic Payments</a> handles machine-to-machine payment workflows on behalf of the agent. Developed in collaboration with the <a href="https://aws.amazon.…+
<p>Anchor Browser is a cloud-based browser automation solution purpose-built for AI agents. Each agent session runs inside a managed browser environment that maintains authentication state, handles navigation, captures network requests, and provides a live view of page interactions.</p>+
<p>Amazon Bedrock AgentCore provides capabilities to build, connect, and optimize agents at scale. Amazon Bedrock AgentCore payments is a fully managed capability within AgentCore that AI agents can use to discover, access, and pay for APIs, Model Context Protocol (MCP) servers, and web conten…+
<p>When an agent running in Anchor Browser encounters a 402 response, AgentCore payments authorizes and completes the transaction within the configured budget. The workflow continues without interruption.</p>+
<h2 id="challenges">Challenges</h2>+
<p>When an autonomous agent encounters an x402-protected resource, the workflow stalls. The agent makes a request, such as fetching a premium research report or calling a paid data enrichment API, and the server responds with HTTP 402 Payment Required. Without a mechanism to pay, the task that…+
<p>Today, developers must build the entire payment stack. This effort spans four categories of complexity:</p>+
<p><strong>Payment protocol handling</strong></p><ul>-
<li>GPT-6 Sol brings strong reasoning and coding capabilities to complex tasks performed throughout the week.</li>-
<li>GPT-6 Luna makes focused, repeatable tasks practical at high volume.</li>-
<li>GPT-6 Astra handles complex reasoning, coding, and long-document work.</li>+
<li>Detecting and parsing the 402 challenge from the HTTP response, and distinguishing payment-required responses from other 4xx errors.</li>+
<li>Constructing the correct payment header with the cryptographic proof in the exact format the merchant expects.</li>+
<li>Supporting multiple <a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/payments-process-payment.html" target="_blank" rel="noopener">payment schemes</a> (exact, upto, and protocol variants) without hardcoding vendor-specific logic into the agent.</li>+
<li>Maintaining compatibility across x402 merchant implementations that might vary in challenge format, supported stablecoins, or settlement timing.</li></ul>-
<p>All three accept text and image input, client-side tool use, and prompt caching. They differ on reasoning effort. GPT-6 Sol and GPT-6 Luna accept none, low, medium, high, xhigh, and max. GPT-6 Astra accepts the same levels except none. For GPT-6 Sol and GPT-6 Luna, see <a href="https://a…-
<p>Global cross-Region inference routes requests across supported commercial AWS Regions where the model is deployed, giving you broad access to Amazon Bedrock capacity. You invoke it by passing a global cross-Region inference profile ID in place of a model ID. Your source Region is where you …-
<p>The following table lists the global cross-Region inference profile IDs and the source Regions covered in this post.</p>-
<table border="1px" width="100%" cellpadding="10px">-
<tbody>-
<tr>-
<td><strong>Global cross-Region inference profiles</strong></td>-
<td><strong>Source Regions</strong></td>-
<td><strong>Destination Regions</strong></td>-
</tr>-
<tr>-
<td>-
<p>global.openai.gpt-6-sol</p>-
<p>global.openai.gpt-6-luna</p>-
</td>-
<td>-
<p>Asia Pacific (Singapore) ap-southeast-1</p>-
<p>Asia Pacific (Jakarta) ap-southeast-3</p>-
<p>Asia Pacific (Malaysia) ap-southeast-5</p>-
<p>Asia Pacific (Thailand) ap-southeast-7</p>-
<p>Asia Pacific (Taipei) ap-east-2</p>-
</td>-
<td>Supported commercial AWS Regions where the model is deployed</td>-
</tr>-
<tr>-
<td>global.openai.gpt-6-astra</td>-
<td>Asia Pacific (Singapore) ap-southeast-1</td>-
<td>Supported commercial AWS Regions where the model is deployed</td>-
</tr>-
</tbody>-
</table>-
<p>Inference profile availability and Region support change as AWS adds Regions and profiles, so confirm both on the model card before you build: <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-6-sol.html" target="_blank" rel="noopener">GPT-6 Sol</a…-
<h2 id="getting-started-with-openai-models-on-amazon-bedrock">Getting started with OpenAI models on Amazon Bedrock</h2>-
<p>Start with the prerequisites, then invoke any of the three profiles through the Converse API, the OpenAI-compatible APIs, or your existing coding client.</p>-
<h3 id="prerequisites">Prerequisites</h3>-
<ol type="1">-
<li>An IAM identity with permission to invoke the profile. The IAM policy in the Security and permissions section grants only what these examples need.</li>-
<li>Your source Region activated. Only the Region you call from needs activating. You do not activate destination Regions, which run on Amazon Bedrock managed capacity. Singapore (<code>ap-southeast-1</code>) is a Region that is enabled by default. Jakarta (<code>ap-southeas…-
<li>A current AWS SDK or CLI. The OpenAI-compatible examples also require the OpenAI SDK and the Amazon Bedrock token generator. Install them with <code>pip install boto3 openai aws-bedrock-token-generator</code>.</li>-
</ol>-
<p>The Amazon Bedrock console lists all three global cross-Region inference profiles under system-defined inference profiles. See Figure 1.</p>+
<p><strong>Security and key management</strong></p>+
<ul>+
<li>Storing a private key to sign payments, requiring secure key storage within an environment exposed to untrusted inputs.</li>+
<li>Managing wallet lifecycle operations, including key rotation, credential refresh, and provider failover.</li>+
</ul>+
<p><strong>Operational resilience</strong></p>+
<ul>+
<li>Resubmitting the original request with the payment header while preserving session state, cookies, and request context.</li>+
<li>Providing idempotency, which is essential for wallet operations.</li>+
<li>Enforcing per-session and per-transaction spend limits with real-time budget tracking across concurrent agent executions.</li>+
</ul>+
<p><strong>Observability and compliance</strong></p>+
<ul>+
<li>Capturing every payment attempt, approval, denial, and settlement in audit logs for compliance and reconciliation.</li>+
</ul>+
<p>Without a managed payment service, the agent must internalize the entire payment stack. On every x402-protected call that returns a 402 response, the agent must orchestrate the full payment flow internally, including:</p>+
<ul>+
<li>Signing the proof.</li>+
<li>Attaching the correct header.</li>+
<li>Retrying the request.</li>+
<li>Settling the transaction.</li>+
<li>Logging the result.</li>+
</ul>+
<p>Each of these steps requires custom code that developers must build, secure, and maintain. Figure 1 illustrates this architecture. The agent contains eight tightly coupled components (Wallet, Private Keys, Budget Controls, Sign Proof, Attach Header, Retry Logic, Settle Payment, and Logging)…<div style="width: 810px" class="wp-caption alignnone">-
<a href="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/09/ML-21759-1-1.png" target="_blank" rel="noopener"><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/09/ML-21759-1-1.png" alt="The three global Op…-
<p class="wp-caption-text">Figure 1: The three global OpenAI GPT-6 inference profiles among the system-defined profiles in the Amazon Bedrock console</p>+
<a href="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/08/ML-21771-1-1.png" target="_blank" rel="noopener"><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/08/ML-21771-1-1.png" alt="Agent payment stack…+
<p class="wp-caption-text">Figure 1: Agent payment stack</p>+
</div>+
<p>The security considerations extend beyond the engineering effort.</p>+
<p><strong>Uncontrolled spending.</strong> Without hard spending limits enforced at the infrastructure level, a bug, retry loop, prompt injection, or inadvertent access can trigger unintended payments. An agent retrying a paid endpoint in a loop continues to authorize payments unti…+
<p><strong>Key exposure.</strong> When private keys reside inside the agent runtime, they share an execution environment with untrusted web pages, third-party tools, and external dependencies. These vectors might inadvertently disclose the credentials that control real funds.</p…+
<p><strong>Signing flow exposure.</strong> If the signing infrastructure is accessible from the runtime, a threat actor can attempt to access the key or redirect payments to an address under unauthorized control. Effective mitigation requires that the key doesn’t enter the runtime …+
<p>Browser-based agents introduce an additional constraint: the payment must occur within the same browser session. Otherwise, session recordings and live view no longer match what actually executed.</p>+
<h2 id="solution">Solution</h2>+
<p>Anchor Browser and AgentCore payments address this complexity by moving the entire payment stack into managed infrastructure.</p>+
<p>Unlike a stateless tool call, Anchor Browser provides a real cloud browser with persistent identity, repeatable and deterministic workflows, and the session context needed to log in, navigate, and finish tasks reliably. Authentication, navigation, network requests, recordings, and live view…+
<p>AgentCore payments serves as the payment layer. At the center of the service is the Payment Manager, the top-level resource that coordinates payment operations for the AWS account. Creating a Payment Manager requires specifying an authorizer type and an IAM role. AgentCore then provisions a…+
<p>The remaining components connect the Payment Manager to external wallet infrastructure:</p>+
<ul>+
<li>A <strong>PaymentConnector</strong> integrates the Payment Manager with an external wallet provider, either Coinbase Developer Platform (Coinbase CDP) or Stripe Privy.</li>+
<li>A <strong>PaymentCredentialProvider</strong> stores wallet provider credentials securely in AgentCore Identity.</li>+
<li>A <strong>PaymentInstrument</strong> identifies the specific wallet address from which funds are drawn.</li>+
</ul>+
<p>Anchor Browser sets up wallets through AgentCore payments using a supported wallet provider, without placing wallet secrets or private keys inside the agent runtime. AgentCore payments handles wallet operations through the configured provider. For endpoint discovery, AgentCore provides a cu…+
<p>AgentCore payments restructures the payment architecture. Sensitive operations move out of the agent runtime and into a managed service layer. The Anchor Agent holds only two payment-related components: a budget session and the x402 tool. The infrastructure, including authentication, wallet…+
<div style="width: 810px" class="wp-caption alignnone">+
<a href="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/08/ML-21771-2-1.png" target="_blank" rel="noopener"><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/08/ML-21771-2-1.png" alt="Anchor Agent connec…+
<p class="wp-caption-text">Figure 2: Anchor Browser integrates with AgentCore payments</p></div>-
<h3 id="invoke-gpt-6-models-through-amazon-bedrock-runtime">Invoke GPT-6 models through Amazon Bedrock Runtime</h3>-
<p>Each model supports three access paths on this endpoint: the Amazon Bedrock Converse API, the OpenAI Responses API, and the OpenAI Chat Completions API. The OpenAI-compatible APIs are called on the <code>/openai/v1</code> paths rather than through the AWS SDKs, and the endpoint …-
<p><strong>Converse API.</strong> This example calls GPT-6 Sol from Asia Pacific (Singapore) and logs the response. Set <code>BEDROCK_PROFILE_ID</code> to <code>global.openai.gpt-6-luna</code> or <code>global.openai.gpt-6-astra</code> to switch m…+
<h3 id="how-the-payment-flow-works">How the payment flow works</h3>+
<p>The following steps describe what happens end to end, from the moment a browser session encounters an x402-protected resource to the moment the agent receives the response and continues the task.</p>+
<ol type="1">+
<li><strong>Anchor Browser creates a dedicated AgentCore PaymentSession for the browser session.</strong> When the session starts with x402 turned on, Anchor Browser provisions a PaymentSession through AgentCore payments, linking the browser session to a configured payment instrum…+
<li><strong>The browser receives an HTTP 402 Payment Required response.</strong> The agent navigates to a URL or makes a fetch or XMLHttpRequest (XHR) request. The merchant responds with a 402 challenge specifying the amount, accepted payment methods, and payment address.</li&g…+
<li><strong>The browser selects a compatible payment method.</strong> Anchor Browser reads the 402 challenge payload and matches the requested payment method against the instrument linked to the PaymentSession.</li>+
<li><strong>AgentCore verifies the session budget and generates the cryptographic payment proof.</strong> AgentCore payments validates that the payment amount falls within the session spending limit. The service then signs the transaction using the configured wallet provider (Coin…+
<li><strong>The browser retries the original request with the payment header.</strong> The browser attaches the signed proof as <code>PAYMENT-SIGNATURE</code> for x402 v2 or <code>X-PAYMENT</code> for x402 v1, then retries the original request exactly once.…+
<li><strong>The merchant verifies and settles the payment, then returns the protected resource.</strong> The merchant validates the cryptographic proof, settles the transaction on-chain, and serves the content. The agent continues the task.</li>+
</ol>+
<p>Wallet credentials remain with AgentCore and the configured wallet provider throughout this flow.</p>+
<h2 id="prerequisites">Prerequisites</h2>+
<p>Before you begin, make sure that you have a valid Anchor Browser API key (<code>ANCHOR_API_KEY</code>). To create one, see the Anchor Browser <a href="https://docs.anchorbrowser.io/quickstart/use-via-api" target="_blank" rel="noopener">Quick Start</a> guide.</p>…+
<h2 id="setting-up-automatic-x402-payments">Setting up automatic x402 payments</h2>+
<p>Setting up agentic payments for Anchor Browser requires one session property. Set <code>session.x402</code> to <code>true</code>. The property defaults to <code>false</code>. When enabled, the browser session can automatically access x402-protected websit…+
<p>The following examples show how to create a payment-enabled session for Anchor Browser using cURL and JavaScript:</p>+
<p><strong>cURL</strong></p><div class="hide-language">-
<pre><code class="language-python">import logging-
import os-
import boto3-
-
# AWS_REGION overrides this default, so set it to your source Region or unset it.-
REGION = os.environ.get("AWS_REGION", "ap-southeast-1")-
PROFILE_ID = os.environ.get("BEDROCK_PROFILE_ID", "global.openai.gpt-6-sol")-
PROMPT = (-
"In three bullet points, explain when a workload should use "-
"cross-Region inference instead of calling a model in a single Region."-
)-
-
logging.basicConfig(format="%(levelname)s %(message)s")-
log = logging.getLogger("bedrock-cris")-
log.setLevel(logging.INFO)-
-
client = boto3.client("bedrock-runtime", region_name=REGION)-
-
# AccessDeniedException points at the IAM policy. ValidationException usually-
# means the model ID is not a global cross-Region inference profile.-
response = client.converse(-
modelId=PROFILE_ID,-
messages=[{"role": "user", "content": [{"text": PROMPT}]}],-
inferenceConfig={"maxTokens": 1024},-
# GPT-6 Sol and Luna accept none through max. GPT-6 Astra rejects none.-
additionalModelRequestFields={"reasoning": {"effort": "low"}},-
)-
-
# Any effort above none can prepend a reasoningContent block, so pick the text-
# block by key rather than by position.-
text = "".join(b["text"] for b in response["output"]["message"]["content"] if "text" in b)-
-
log.info("Called %s from %s", PROFILE_ID, REGION)-
log.info("Stop reason: %s", response["stopReason"])-
log.info("Response:\n%s", text)</code></pre>+
<pre><code class="language-bash">curl --request POST+
--url https://api.anchorbrowser.io/v1/sessions+
--header "anchor-api-key: $ANCHOR_API_KEY"+
--header "content-type: application/json"+
--data '{"session":{"x402":true}}'</code></pre></div>-
<p><strong>OpenAI Chat Completions API.</strong> Point the OpenAI SDK at the Regional endpoint and pass the same profile ID.</p>+
<p><strong>JavaScript</strong></p><div class="hide-language">-
<pre><code class="language-python">import logging-
import os-
from aws_bedrock_token_generator import provide_token-
from openai import OpenAI-
-
REGION = os.environ.get("AWS_REGION", "ap-southeast-1")-
PROFILE_ID = os.environ.get("BEDROCK_PROFILE_ID", "global.openai.gpt-6-sol")-
PROMPT = "List three uses for a message queue."-
-
logging.basicConfig(format="%(levelname)s %(message)s")-
log = logging.getLogger("bedrock-cris")-
log.setLevel(logging.INFO)-
-
# provide_token mints a short-term key from your AWS credentials, valid up to 12 hours.-
client = OpenAI(-
base_url=f"https://bedrock-runtime.{REGION}.amazonaws.com/openai/v1",-
api_key=provide_token(region=REGION),-
)-
-
response = client.chat.completions.create(-
model=PROFILE_ID,-
messages=[{"role": "user", "content": PROMPT}],-
max_completion_tokens=256,-
)+
<pre><code class="language-javascript">const response = await fetch('https://api.anchorbrowser.io/v1/sessions', {+
method: 'POST',+
headers: {+
'anchor-api-key': process.env.ANCHOR_API_KEY,+
'content-type': 'application/json',+
},+
body: JSON.stringify({ session: { x402: true } }),+
});+
const { data: session } = await response.json();+
console.log(session.cdp_url);</code></pre>+
</div>+
<p>After connected through Chrome DevTools Protocol, the agent navigates normally. You don’t need to include a wallet key or payment header in your automation code. The browser handles 402 challenges, payment signing, and retries transparently for document navigation, fetch, and XHR requests.&…+
<h2 id="payment-session-limits-and-behavior">Payment session limits and behavior</h2>+
<p>Anchor Browser enforces the following guardrails at the session level through AgentCore payments integration. Each payment-ready browser session operates within configured spending and time constraints. For specific limits, refer to the <a href="https://docs.anchorbrowser.io/advanced/aut…+
<p>If the merchant response is malformed, no compatible network is offered, the budget is exhausted, or AgentCore payments rejects the payment, the browser returns the original 402 response to the page unchanged. Your automation code can then handle the 402 as a standard HTTP error.</p>+
<p>The x402 session property controls payments to third-party resources only. The property doesn’t replace Anchor credits and doesn’t pay for the browser session.</p>+
<h2 id="automation-code-for-anchor-browser">Automation code for Anchor Browser</h2>+
<p>Your automation code for Anchor Browser remains unchanged. The following example demonstrates that no payment-specific code is required:</p>+
<div class="hide-language">+
<pre><code class="language-javascript">const { chromium } = require('playwright');+
// Connect to the x402-enabled session via CDP+
const browser = await chromium.connectOverCDP(session.cdp_url);+
const page = await browser.newPage();+
// Navigate to an x402-protected resource exactly as with a free page+
await page.goto('https://premium-research.example.com/market-report');+
// The page loaded, the payment was handled automatically+
// Extract content as normal+
const content = await page.textContent('article');</code></pre>+
</div>+
<p>No wallet logic, no payment header construction, and no retry code. The agent navigates to the URL. If the server returns 402, Anchor Browser coordinates with AgentCore payments to sign the payment proof, retries the request with the appropriate payment header, and delivers the content to t…+
<p>This pattern applies uniformly to paywalled journalism, licensed financial data, gated API documentation, metered research databases, and other resources that gate content behind a 402 challenge.</p>+
<h2 id="using-the-built-in-x402-tool-for-api-calls">Using the built-in x402 tool for API calls</h2>+
<p>Paid resources aren’t limited to web pages. Many are APIs that expect POST, PUT, or other HTTP methods. Common examples include data enrichment services, premium inference endpoints, and licensed content APIs. For these use cases, Anchor Browser agents include a built-in x402 tool that you …+
<p>Your agent makes the API call through fetch or XHR. If the server returns a 402 challenge, the browser coordinates payment signing through AgentCore payments and retries the request with the signed payment header. Your code receives the response as though the endpoint were free. The tool is…+
<div class="hide-language">+
<pre><code class="language-javascript">// Fetch call to a paid API endpoint within the x402-enabled session+
const response = await page.evaluate(async () =&gt; {+
const res = await fetch('https://data-enrichment.example.com/api/v1/enrich', {+
method: 'POST',+
headers: { 'content-type': 'application/json' },+
body: JSON.stringify({ company_domain: 'example.com' }),+
});+
return res.json();+
});+
// If the API returned 402, AgentCore handled payment automatically+
// The response contains the enriched data+
console.log(response);</code></pre>+
</div>+
<p>Your automation code doesn’t receive wallet credentials. Automatic payments are available only when <code>session.x402</code> is set to <code>true</code> and remain subject to the spending and expiration limits described in the previous section.</p>+
<h2 id="key-benefits">Key benefits</h2>+
<p>This integration moves payment from application code to the infrastructure layer:</p>+
<p><strong>No payment infrastructure to build.</strong> No wallet SDK to integrate, no 402 response parser to write, no retry loop to implement, no header construction logic to maintain, and no custom audit logging to build. AgentCore payments manages the entire payment stack.</…+
<p><strong>No changes to existing tooling.</strong> Playwright scripts, Puppeteer automations, Chrome DevTools Protocol commands, and agent flows in Anchor Browser continue to function exactly as before. Payment is a session capability attached to the browser, not a modification to…+
<p><strong>Private keys don’t enter the runtime.</strong> Signing and settlement happen inside AgentCore payments. The service communicates with Coinbase CDP or Stripe Privy through secure credential storage in AgentCore Identity. The agent runtime doesn’t have access to key materi…+
<p><strong>Budgets are enforced at the infrastructure level.</strong> Every session operates within defined spend limits that AgentCore enforces before authorizing a payment. Amazon Bedrock AgentCore Observability provides full payment audit trails through Amazon CloudWatch. When a…+
<p><strong>Paid tasks complete successfully.</strong> Paid GET pages load. Paid API calls return responses. The agent completes the workflow rather than stopping at a 402 response and requiring manual intervention.</p>+
<p><strong>Billing is consolidated.</strong> Anchor Browser settles third-party x402 charges in credits on the same invoice as browser session time. There’s no separate crypto custody to manage, no USDC balance to monitor, and no on-chain settlement for the finance team to reconcil…+
<h2 id="conclusion">Conclusion</h2>+
<p>Anchor Browser, integrated with AgentCore payments, equips AI agents to handle x402 payment challenges autonomously for paywalled web pages and paid API endpoints. Wallet credentials stay out of agent code, and no custom payment infrastructure is required.</p>+
<p>As more of the web moves to per-request pricing, agents that lack a payment mechanism can’t complete tasks involving paid resources. This integration addresses that gap: agents complete paid workflows end to end, operating within defined budgets, with full observability through AgentCore Ob…+
<p>To get started, explore the following resources:</p>+
<ul>+
<li><a href="https://docs.anchorbrowser.io/advanced/automatic-x402-payments" target="_blank" rel="noopener">Automatic x402 payments in Anchor Browser</a></li>+
<li><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/payments.html" target="_blank" rel="noopener">AgentCore payments developer guide</a></li>+
<li><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/payments-browser.html" target="_blank" rel="noopener">AgentCore payments with browser integration</a></li>+
<li><a href="https://aws.amazon.com/marketplace/pp/prodview-ujbrqwp274l6g?sr=0-2&amp;ref_=beagle&amp;applicationId=AWSMPContessa" target="_blank" rel="noopener">Anchor Browser on AWS Marketplace</a></li>+
</ul>+
<p style="clear: both"></p>+
<hr style="width: 100%">+
<h2>About the authors</h2>+
<footer>+
<div class="blog-author-box" style="padding-top: 2.0em">+
<div class="blog-author-image" style="margin-right: 1.0em">+
<img loading="lazy" class="alignnone size-full" src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/08/ML-21771-3-1.jpg" alt="Cher Simon" width="100" height="133">+
</div>+
<h3 class="lb-h4">Cher Simon</h3>+
<p style="overflow: hidden"><a href="https://www.linkedin.com/in/chersimon" target="_blank" rel="noopener">Cher</a> is a Principal Deep Learning Architect at AWS, where she helps customers, startups, and AWS Partners build large-scale, high-performance AI/ML solutions. A publishe…+
</div>+
<div class="blog-author-box" style="padding-top: 2.0em">+
<div class="blog-author-image" style="margin-right: 1.0em">+
<img loading="lazy" class="alignnone size-full" src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/08/ML-21771-4-1.jpg" alt="Guy Ben Simhon" width="100" height="133">+
</div>+
<h3 class="lb-h4">Guy Ben Simhon</h3>+
<p style="overflow: hidden"><a href="https://il.linkedin.com/in/guy-bensimhon" target="_blank" rel="noopener">Guy</a> is a Co-Founder and CPO at Anchor Browser, leading product and strategy. He focuses on building infrastructure that enables AI agents to reliably interact with th…+
</div>+
<div class="blog-author-box" style="padding-top: 2.0em">+
<div class="blog-author-image" style="margin-right: 1.0em">+
<img loading="lazy" class="alignnone size-full" src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/08/ML-21771-5-1.jpg" alt="Elay Gelbart" width="100" height="133">+
</div>+
<h3 class="lb-h4">Elay Gelbart</h3>+
<p style="overflow: hidden"><a href="https://www.linkedin.com/in/elaygelbart" target="_blank" rel="noopener">Elay</a> is a Founding and Lead Engineer at Anchor Browser, pioneering its browser infrastructure and core engineering. He specializes in large-scale browser infrastructur…+
</div>+
<div class="blog-author-box" style="padding-top: 2.0em">+
<div class="blog-author-image" style="margin-right: 1.0em">+
<img loading="lazy" class="alignnone size-full" src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/08/ML-21771-6-1.jpg" alt="Chethan Shriyan" width="100" height="133">+
</div>+
<h3 class="lb-h4">Chethan Shriyan</h3>+
<p style="overflow: hidden"><a href="https://www.linkedin.com/in/chethanshriyan/" target="_blank" rel="noopener">Chethan</a> is a Principal Product Manager – Technical at AWS. He has more than 12 years of experience in product and business management. Chethan is passionate about …+
</div>+
<div class="blog-author-box" style="padding-top: 2.0em">+
<div class="blog-author-image" style="margin-right: 1.0em">+
<img loading="lazy" class="alignnone size-full" src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/08/ML-21771-7-1.jpg" alt="Peter Jiang" width="100" height="133">+
</div>+
<h3 class="lb-h4">Peter Jiang</h3>+
<p style="overflow: hidden"><a href="https://www.linkedin.com/in/peterjiangsde/" target="_blank" rel="noopener">Peter</a> is a Senior Software Developer at AWS, based in Seattle, WA. He is a core member of the engineering team behind the Amazon Bedrock AgentCore payments initiati…+
</div>+
</footer></content:encoded>+
+
+
+
</item>+
<item>+
<title>Manage private pricing offers for Amazon Bedrock with managed entitlements</title>+
<link>https://aws.amazon.com/blogs/machine-learning/manage-private-pricing-offers-for-amazon-bedrock-with-managed-entitlements/</link>+
+
<dc:creator><![CDATA[Daniel Wirjo]]></dc:creator>+
<pubDate>Tue, 13 Oct 2026 17:17:25 +0000</pubDate>+
<category><![CDATA[Amazon Bedrock]]></category>+
<category><![CDATA[Intermediate (200)]]></category>+
<category><![CDATA[Technical How-to]]></category>+
<guid isPermaLink="false">96270fda2506ac4609e9172e331312d358ae21d1</guid>-
log.info("Called %s from %s", PROFILE_ID, REGION)-
log.info("Response:\n%s", response.choices[0].message.content)</code></pre>-
</div>-
<p>When migrating an existing OpenAI client:</p>+
<description>Managing AI model access across dozens or hundreds of AWS accounts creates friction when each account must accept AWS Marketplace Private Pricing Offers individually. This post shows two ways to activate MPPO entitlements in AWS License Manager: a lightweight script for a one-time …+
<content:encoded><p>Managing AI model access across dozens or hundreds of AWS accounts creates operational friction when each workload account must subscribe and accept AWS Marketplace Private Pricing Offers (MPPOs) individually. <a href="https://aws.amazon.com/blogs/machine-learn…+
<p>In this post, we show you two ways to activate AWS Marketplace Private Pricing Offer (MPPO) entitlements in AWS License Manager. Use the lightweight script when you want a one-time, no-infrastructure fix for received licenses you already trust. Use the CDK automation when you want ongoing e…+
<h2 id="why-automate-grant-activation">Why automate grant activation</h2>+
<p>With AWS Marketplace Private Pricing Offers, you can negotiate custom rates for third-party models on Amazon Bedrock. After an eligible private offer is accepted, AWS Marketplace creates a license in AWS License Manager. In AWS Organizations with all features enabled, organization-level gra…+
<p>Teams often manage this by checking the AWS License Manager console and activating grants manually. Manual checks work, but they add effort and are easy to miss. Until someone activates the grant, negotiated pricing does not apply. The same effort appears as teams adopt new models or renew …+
<h2 id="solution-overview">Solution overview</h2>+
<p>The sample repository provides two paths:</p><ul>-
<li>Set the model parameter on every request, including those referencing a previous response.</li>-
<li>Use supported tool types: <code>function</code>, <code>mcp</code>, <code>custom</code>, <code>namespace</code>, and <code>tool_search</code>.</li>-
<li>Configure the inference profile ID directly in your client rather than querying the models endpoint.</li>+
<li><strong>Path 1 – The lightweight path</strong> is a standalone script that lists received licenses and prints a dry-run plan. It only creates and activates organization-wide grants when you re-run it with <code>--apply --confirm-account-id</code>. It has no seller …+
<li><strong>Path 2 – The event-driven path</strong> uses AWS Cloud Development Kit (AWS CDK) to deploy ongoing automation in your AWS management account.</li></ul>-
<h3 id="set-up-the-chatgpt-desktop-app-and-codex-cli">Set up the ChatGPT desktop app and Codex CLI</h3>-
<p>The ChatGPT desktop app and the Codex CLI share <code>~/.codex/config.toml</code>, so one change covers both. Of the two built-in Amazon Bedrock providers, only <code>amazon-bedrock-runtime</code> accepts an inference profile.</p>-
<div class="hide-language">-
<pre><code class="language-toml">model = "global.openai.gpt-6-astra"-
model_provider = "amazon-bedrock-runtime"-
[model_providers.amazon-bedrock-runtime.aws]-
region = "ap-southeast-1"</code></pre>-
</div>-
<p>SigV4 signing means there is no key to rotate. Add <code>profile = "&lt;your-profile&gt;"</code> for a non-default profile, and set <code>region</code> explicitly, because the client otherwise falls back to <code>AWS_REGION</code>. Substitute anot…-
<p>Codex reports a 272,000-token window for these profiles, which is its own bundled figure rather than a service limit. Raise it with <code>model_context_window</code>. This configuration needs Codex CLI 0.148 or later.</p>-
<p>Figure 2 shows the result in the app.</p>-
<div style="width: 810px" class="wp-caption alignnone">-
<a href="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/09/ML-21759-2-1.png" target="_blank" rel="noopener"><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/09/ML-21759-2-1.png" alt="The ChatGPT desktop…-
<p class="wp-caption-text">Figure 2: The ChatGPT desktop app running GPT-6 Astra on Amazon Bedrock</p>+
<p>Choose one of the following implementation paths. Use Path 1 for one-time activation without CDK. Use Path 2 for ongoing event-driven automation.</p>+
<h3 id="path-1-lightweight-script-one-time-activation">Path 1: Lightweight script (one-time activation)</h3>+
<p>Use this path when you need one-time activation without deploying CDK. The script lists every received license in the management account, so use the dry run as your review gate before applying changes.</p>+
<ol type="1">+
<li>Clone the sample repository locally and move into the project directory.+
<div class="hide-language">+
<pre><code class="language-bash">git clone https://github.com/aws-samples/sample-bedrock-managed-entitlements.git+
cd sample-bedrock-managed-entitlements</code></pre>Diff display stops at 400 lines. The line counts above are from the whole diff. 56 lines shown here cut at 300 characters. The raw artifact at this commit is linked above.