Skip to main content
Connect an existing card so an agent can request single-use card details for an authorized purchase. Basis Theory captures your card details through hosted fields, and Conto keeps a masked record.
Connected cards are available to selected pilot organizations. We’re waiting for production access; before making a live purchase, confirm access and card eligibility with Conto. The integration uses Visa Intelligent Commerce, and dashboard setup supports single-use authorizations.

​
Manual records and connected cards

See card management for manual records. For an existing private Card Access integration, use its maintenance reference.

​
Connect and authorize

  1. In an organization with pilot access, open an agent’s Connected Cards tab and choose Connect a card. You can also connect one during new-agent setup.
  2. Select the cardholder and enter the card in the secure hosted fields. The cardholder must be able to complete verification.
  3. Set the agent’s spending limits. Choose the merchant, checkout URL, country, amount cap, and expiration for the first authorization.
  4. Review the cardholder, merchant, amount, expiration, and agent limits. Choose Edit details to make changes, or authorize and complete verification in the secure provider dialog. When someone else is the cardholder, choose Copy verification link and share it with them. After signing in to the same organization, they land on the selected authorization and choose Verify mandate. The link does not grant access, and Conto does not send it automatically.
An authorization is called a mandate in the dashboard and API. Connecting a card or creating a mandate does not make a purchase. The mandate must be active before the agent can request a credential, and each request remains subject to Conto’s controls.

​
Card and authorization statuses

Agent limits cannot exceed the limits configured for the card. Each merchant authorization also has an amount cap and expiration, which stay unchanged if you raise the agent’s limit.

​
Complete checkout in your application

Use the SDK to request a credential and deliver it directly to your checkout integration. Keep payment credentials out of model prompts, tool results, analytics, and application logs. The MCP connected-card tool lists masked cards only; it does not issue credentials. The SDK returns a credential once. Retrying with the same idempotency key returns the existing request state without revealing that credential again. Do not create a new request just to recover a lost response: investigate the original request first to avoid duplicate issuance. After receiving the credential, acknowledge delivery as described in connected-card credential delivery. Acknowledgment records receipt by your application, not merchant acceptance or settlement. Confirm the actual purchase using the merchant receipt and card activity.

​
Revoke an authorization

From the agent’s Connected Cards tab, revoke the relevant mandate to block new requests. Conto asks the provider to cancel the allowance and retries if cancellation is still pending. The authorization shows New credential requests are blocked immediately; Provider cancellation confirmed appears only after the provider operation completes. Use Refresh cancellation status to check again. If it stays pending, contact support with the authorization ID shown. Revocation does not refund a purchase or freeze the source card. If a credential request is already in progress or its outcome is uncertain, review the reconciliation item before retrying checkout. An already issued credential may still exist. Check the Conto request ID against the merchant receipt and provider records before marking a purchase complete. A delivery acknowledgment alone does not confirm it.

​
Troubleshooting

  • Card option missing: Confirm that the selected organization has pilot access. Adding a manual card record will not enable this feature.
  • Verification waiting: Sign in as the selected cardholder and resume verification from the agent. Another organization member cannot verify for them.
  • Verification failed: Retry from the existing mandate. If it continues to fail, contact support with the request or mandate ID and a redacted error description, never card details or verification codes.
  • Credential request denied: Check mandate status, expiration, merchant scope, spending limits, and any required human review before retrying.
  • Delivery or checkout outcome unknown: Investigate the existing request. A new idempotency key creates a new issuance attempt rather than recovering the original credential.