feat(identity): add payment credential provider mutations

README.md

@@ -69,8 +69,11 @@ agentcore                          # interactive TUI
 │   │   ├── update                 # update an OAuth2 credential provider
 │   │   └── delete                 # delete an OAuth2 credential provider
 │   └── payment-credential-provider
+│       ├── create                 # store Coinbase CDP or Stripe/Privy credentials for payment connectors
 │       ├── get                    # get a payment credential provider
-│       └── list                   # list payment credential providers
+│       ├── list                   # list payment credential providers
+│       ├── update                 # replace a payment credential provider's credentials
+│       └── delete                 # delete a payment credential provider
 ├── runtime                        # inspect deployed AgentCore Runtimes
 │   ├── get                        # fetch a Runtime by id
 │   ├── list                       # list Runtimes (server-side paginated)
@@ -207,8 +210,9 @@ one resource of the requested type, `--name` may be omitted.
 
 The `payment` commands call the Payments control and data planes directly, with
 no project involved. This command family currently provides read-only inspection
-of existing managers, connectors, sessions, instruments, and payment credential
-providers. It does not create IAM roles or change provider credentials.
+of existing managers, connectors, sessions, and instruments. It does not create IAM
+roles. The separate `identity payment-credential-provider` commands can create,
+inspect, replace, or delete stored Coinbase CDP and Stripe/Privy credentials.
 
 ```bash
 # Inspect managers and their connectors.
@@ -221,6 +225,10 @@ agentcore payment connector get --manager-id <manager id> --connector-id <connec
 agentcore identity payment-credential-provider list --json
 agentcore identity payment-credential-provider get --name <provider name>
 
+# Store provider credentials from files, not inline command arguments.
+agentcore identity payment-credential-provider create --name cdp-creds --vendor CoinbaseCDP \
+  --api-key-id <id> --api-key-secret file://api-key-secret.txt --wallet-secret file://wallet-secret.txt
+
 # Session and instrument commands take the parent manager ID and a user id.
 agentcore payment session list --manager-id <manager id> --user-id alice
 agentcore payment instrument list --manager-id <manager id> --user-id alice

src/handlers/identity/payment-credential-provider/__fixtures__/CreatePaymentCredentialProviderCommand.6a6a6d692f0c855a.json

@@ -0,0 +1,19 @@
+{
+  "name": "agentcore-cli-payment-fixture-stripe",
+  "credentialProviderVendor": "StripePrivy",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:603141041947:token-vault/default/paymentcredentialprovider/agentcore-cli-payment-fixture-stripe",
+  "providerConfigurationOutput": {
+    "stripePrivyConfiguration": {
+      "appId": "agentcore-cli-fixture-app",
+      "appSecretArn": {
+        "secretArn": "arn:aws:secretsmanager:us-west-2:603141041947:secret:bedrock-agentcore-identity!default/payment/stripeprivy/agentcore-cli-payment-fixture-stripe-28e8771e/appsecret-Ns6m08"
+      },
+      "authorizationPrivateKeyArn": {
+        "secretArn": "arn:aws:secretsmanager:us-west-2:603141041947:secret:bedrock-agentcore-identity!default/payment/stripeprivy/agentcore-cli-payment-fixture-stripe-28e8771e/authprivkey-7sMU9C"
+      },
+      "authorizationId": "agentcore-cli-fixture-auth",
+      "appSecretSource": "MANAGED",
+      "authorizationPrivateKeySource": "MANAGED"
+    }
+  }
+}

src/handlers/identity/payment-credential-provider/__fixtures__/CreatePaymentCredentialProviderCommand.7301309043cb46c3.json

@@ -0,0 +1,18 @@
+{
+  "name": "agentcore-cli-payment-fixture",
+  "credentialProviderVendor": "CoinbaseCDP",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:603141041947:token-vault/default/paymentcredentialprovider/agentcore-cli-payment-fixture",
+  "providerConfigurationOutput": {
+    "coinbaseCdpConfiguration": {
+      "apiKeyId": "agentcore-cli-fixture-key",
+      "apiKeySecretArn": {
+        "secretArn": "arn:aws:secretsmanager:us-west-2:603141041947:secret:bedrock-agentcore-identity!default/payment/coinbasecdp/agentcore-cli-payment-fixture-541ff54c/apikey-eNjrnd"
+      },
+      "walletSecretArn": {
+        "secretArn": "arn:aws:secretsmanager:us-west-2:603141041947:secret:bedrock-agentcore-identity!default/payment/coinbasecdp/agentcore-cli-payment-fixture-541ff54c/wallet-DFZFS6"
+      },
+      "apiKeySecretSource": "MANAGED",
+      "walletSecretSource": "MANAGED"
+    }
+  }
+}

src/handlers/identity/payment-credential-provider/__fixtures__/DeletePaymentCredentialProviderCommand.9ebdd66cb38819e.json

@@ -0,0 +1 @@
+{}

src/handlers/identity/payment-credential-provider/__fixtures__/DeletePaymentCredentialProviderCommand.d4020a1cc9b08a46.json

@@ -0,0 +1 @@
+{}

src/handlers/identity/payment-credential-provider/__fixtures__/UpdatePaymentCredentialProviderCommand.417ee64c8755742b.json

@@ -0,0 +1,24 @@
+{
+  "name": "agentcore-cli-payment-fixture",
+  "credentialProviderVendor": "CoinbaseCDP",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:603141041947:token-vault/default/paymentcredentialprovider/agentcore-cli-payment-fixture",
+  "providerConfigurationOutput": {
+    "coinbaseCdpConfiguration": {
+      "apiKeyId": "agentcore-cli-fixture-key-rotated",
+      "apiKeySecretArn": {
+        "secretArn": "arn:aws:secretsmanager:us-west-2:603141041947:secret:bedrock-agentcore-identity!default/payment/coinbasecdp/agentcore-cli-payment-fixture-541ff54c/apikey-eNjrnd"
+      },
+      "walletSecretArn": {
+        "secretArn": "arn:aws:secretsmanager:us-west-2:603141041947:secret:bedrock-agentcore-identity!default/payment/coinbasecdp/agentcore-cli-payment-fixture-541ff54c/wallet-DFZFS6"
+      },
+      "apiKeySecretSource": "MANAGED",
+      "walletSecretSource": "MANAGED"
+    }
+  },
+  "createdTime": {
+    "$date": "2026-09-08T20:16:25.544Z"
+  },
+  "lastUpdatedTime": {
+    "$date": "2026-09-08T20:16:27.626Z"
+  }
+}

src/handlers/identity/payment-credential-provider/__fixtures__/create-stripe.golden.json

@@ -0,0 +1,19 @@
+{
+  "name": "agentcore-cli-payment-fixture-stripe",
+  "credentialProviderVendor": "StripePrivy",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:603141041947:token-vault/default/paymentcredentialprovider/agentcore-cli-payment-fixture-stripe",
+  "providerConfigurationOutput": {
+    "stripePrivyConfiguration": {
+      "appId": "agentcore-cli-fixture-app",
+      "appSecretArn": {
+        "secretArn": "arn:aws:secretsmanager:us-west-2:603141041947:secret:bedrock-agentcore-identity!default/payment/stripeprivy/agentcore-cli-payment-fixture-stripe-28e8771e/appsecret-Ns6m08"
+      },
+      "authorizationPrivateKeyArn": {
+        "secretArn": "arn:aws:secretsmanager:us-west-2:603141041947:secret:bedrock-agentcore-identity!default/payment/stripeprivy/agentcore-cli-payment-fixture-stripe-28e8771e/authprivkey-7sMU9C"
+      },
+      "authorizationId": "agentcore-cli-fixture-auth",
+      "appSecretSource": "MANAGED",
+      "authorizationPrivateKeySource": "MANAGED"
+    }
+  }
+}

src/handlers/identity/payment-credential-provider/__fixtures__/create.golden.json

@@ -0,0 +1,18 @@
+{
+  "name": "agentcore-cli-payment-fixture",
+  "credentialProviderVendor": "CoinbaseCDP",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:603141041947:token-vault/default/paymentcredentialprovider/agentcore-cli-payment-fixture",
+  "providerConfigurationOutput": {
+    "coinbaseCdpConfiguration": {
+      "apiKeyId": "agentcore-cli-fixture-key",
+      "apiKeySecretArn": {
+        "secretArn": "arn:aws:secretsmanager:us-west-2:603141041947:secret:bedrock-agentcore-identity!default/payment/coinbasecdp/agentcore-cli-payment-fixture-541ff54c/apikey-eNjrnd"
+      },
+      "walletSecretArn": {
+        "secretArn": "arn:aws:secretsmanager:us-west-2:603141041947:secret:bedrock-agentcore-identity!default/payment/coinbasecdp/agentcore-cli-payment-fixture-541ff54c/wallet-DFZFS6"
+      },
+      "apiKeySecretSource": "MANAGED",
+      "walletSecretSource": "MANAGED"
+    }
+  }
+}

src/handlers/identity/payment-credential-provider/__fixtures__/delete-stripe.golden.json

@@ -0,0 +1 @@
+{}

src/handlers/identity/payment-credential-provider/__fixtures__/delete.golden.json

@@ -0,0 +1 @@
+{}

src/handlers/identity/payment-credential-provider/__fixtures__/update.golden.json

@@ -0,0 +1,20 @@
+{
+  "name": "agentcore-cli-payment-fixture",
+  "credentialProviderVendor": "CoinbaseCDP",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:603141041947:token-vault/default/paymentcredentialprovider/agentcore-cli-payment-fixture",
+  "providerConfigurationOutput": {
+    "coinbaseCdpConfiguration": {
+      "apiKeyId": "agentcore-cli-fixture-key-rotated",
+      "apiKeySecretArn": {
+        "secretArn": "arn:aws:secretsmanager:us-west-2:603141041947:secret:bedrock-agentcore-identity!default/payment/coinbasecdp/agentcore-cli-payment-fixture-541ff54c/apikey-eNjrnd"
+      },
+      "walletSecretArn": {
+        "secretArn": "arn:aws:secretsmanager:us-west-2:603141041947:secret:bedrock-agentcore-identity!default/payment/coinbasecdp/agentcore-cli-payment-fixture-541ff54c/wallet-DFZFS6"
+      },
+      "apiKeySecretSource": "MANAGED",
+      "walletSecretSource": "MANAGED"
+    }
+  },
+  "createdTime": "2026-09-08T20:16:25.544Z",
+  "lastUpdatedTime": "2026-09-08T20:16:27.626Z"
+}

src/handlers/identity/payment-credential-provider/create/index.tsx

@@ -0,0 +1,38 @@
+import z from "zod";
+import { InputValidationError } from "../../../../errors";
+import type { AppIO } from "../../../../io";
+import { createHandler, flag } from "../../../../router";
+import { JsonRendererKey } from "../../../../tui";
+import type { Core } from "../../../types";
+import { coreOptsFromCtx, parseTags } from "../../../utils";
+import {
+  PaymentProviderConfigurationResolver,
+  paymentCredentialProviderConfigFlags,
+} from "../flags";
+
+export const createCreatePaymentCredentialProviderHandler = (core: Core, io: AppIO) =>
+  createHandler({
+    name: "create",
+    description: "create a payment credential provider",
+    flags: [
+      flag("name", "the name of the payment credential provider", z.string().optional()),
+      ...paymentCredentialProviderConfigFlags,
+      flag("tags", "tags as key=value (repeatable) or JSON object", z.array(z.string()).optional()),
+    ],
+    handle: async (ctx, flags) => {
+      if (!flags.name) {
+        throw new InputValidationError("required option '--name <name>' not specified");
+      }
+
+      const configuration = await new PaymentProviderConfigurationResolver(flags, io).resolve();
+
+      ctx
+        .require(JsonRendererKey)
+        .renderJson(
+          await core.identity.createPaymentCredentialProvider(
+            { name: flags.name, ...configuration, tags: parseTags(flags.tags) },
+            coreOptsFromCtx(ctx),
+          ),
+        );
+    },
+  });

src/handlers/identity/payment-credential-provider/delete/index.tsx

@@ -0,0 +1,24 @@
+import z from "zod";
+import { InputValidationError } from "../../../../errors";
+import { createHandler, flag } from "../../../../router";
+import { JsonRendererKey } from "../../../../tui";
+import type { Core } from "../../../types";
+import { coreOptsFromCtx } from "../../../utils";
+
+export const createDeletePaymentCredentialProviderHandler = (core: Core) =>
+  createHandler({
+    name: "delete",
+    description: "delete a payment credential provider",
+    flags: [flag("name", "the name of the payment credential provider", z.string().optional())],
+    handle: async (ctx, flags) => {
+      if (!flags.name) {
+        throw new InputValidationError("required option '--name <name>' not specified");
+      }
+
+      ctx
+        .require(JsonRendererKey)
+        .renderJson(
+          await core.identity.deletePaymentCredentialProvider(flags.name, coreOptsFromCtx(ctx)),
+        );
+    },
+  });