Speaking at a joint news conference at the White House, Mr Obama said they had agreed that neither country would engage in cyber economic espionage.
The deal covers the theft of trade secrets but not national security information.
President Xi also pledged to limit greenhouse gas emissions.
Mr Obama said any escalation in China's alleged cybercrimes against the US would prompt sanctions.
"It has to stop," he said. "The question is now, are words followed by action?"
Reflecting on the use of sanctions against either individuals, businesses or state-run companies, he said: "We will apply those, and whatever other tools we have in our tool kit, to go after cybercriminals either retrospectively or prospectively."
Both countries deny taking part in the cybertheft of commercial secrets.
The Chinese president said the two countries would not "knowingly support" such practices and said they would both abide by "norms of behaviour" in cyberspace.
"Confrontation and friction are not the right choice for both sides," said Mr Xi, speaking through a translator.
The cybertheft of intellectual property designed to benefit Chinese industry was described by former National Security Agency Director Keith Alexander as "the greatest transfer of wealth in history".
US officials have alleged that the Chinese state was behind a massive data security breach of government databases as well as attacks on private firms. That kind of breach is not covered by this deal.
Chinese President Xi Jinping wore a dark suit and stood at a podium during lunch at the US state department.
Behind him were his hosts, US Vice-President Joe Biden and US Secretary of State John Kerry. The room was filled with current and former officials, including Henry Kissinger.
The tables were decorated with red cloth napkins and yellow roses. Outside protesters shouted in front of the building: "Shame on the Chinese government".
Inside the room President Xi said he and President Obama had both "demonstrated a firm commitment" to a new model for their relationship.
He made a toast to friendship between the US and China. Most people stood up - but not everybody. People clapped, too, though not very enthusiastically.
Mr Obama thanked Mr Xi for introducing a cap-and-trade emissions trading system to limit greenhouse gas production.
The White House on Friday put out a fact sheet on the US and China's joint national carbon emissions trading scheme set to launch in 2017.
The "cap-and-trade" scheme would see Chinese companies charged to emit pollutants beyond a certain level.
China said it would commit $3.1bn to help developing countries reduce carbon emissions, along with other initiatives outlined in the fact sheet that would align China's climate work with that of the US.
There were also areas of sharp disagreement.
Mr Obama expressed concerns about the growing tensions in the South China Sea.
And he criticised China's human rights record, saying that preventing lawyers, journalists and others from operating freely is an obstacle to China living up to its potential.

The Belgium international, 24, changed the game from the bench but fell awkwardly in injury time.
His agent Patrick de Koster initially said De Bruyne would miss six weeks.
But, after seeing a specialist, the £55m former Wolfsburg player said: "I'll be out for around 10 weeks."
De Bruyne could miss up to 13 league and cup games, including the League Cup final with Liverpool on 28 February, both legs of the Champions League last-16 tie with Dynamo Kiev and the Manchester derby on 20 March.
The Belgian is City's second top goalscorer with 12 this season, four behind striker Sergio Aguero.
De Koster added: "Kevin told me the only thing he can do is work hard and come back. Kevin is sad. His dream is to always be playing football."
De Bruyne scored one goal and set up another to help City to a 4-3 aggregate victory over the Toffees.
Everton goalkeeper Joel Robles, who repeatedly tried to lift up De Bruyne as he lay injured, used social media to say sorry.
"I would like to apologise to Kevin de Bruyne for my reaction to his injury," said the 25-year-old Spaniard.
"In the heat of the moment I didn't realise he was badly hurt. I wish him all the best and a speedy recovery."
US President Barack Obama and Chinese President Xi Jinping have said they will take new steps to address cybercrime.
[NEXT_CONCEPT]
Manchester City midfielder Kevin de Bruyne says he will be out for about 10 weeks after injuring his right knee during Wednesday's League Cup semi-final victory over Everton.