​

Custody Modes

Before you link a wallet, decide which custody mode you want. In Conto, these are two separate questions:

1. Custody. Who can sign the transfer?
2. Enforcement. Can Conto actually stop the transfer, or only govern the path that goes through Conto?

​

Quick Comparison

​

What Policies Mean In Each Mode

​

Managed Wallets

With a managed wallet, Privy’s secure wallet infrastructure protects the key material. Conto does not store the wallet’s raw private key. Conto stays in its policy-gated execution path, and you choose the root-control model for each new wallet.

• Conto evaluates the payment.
• If approved, Conto orchestrates execution.
• If denied, the payment does not execute through Conto.
• The agent uses the standard request -> execute flow.

Create a managed wallet in the dashboard or use POST /api/wallets with custodyMode=MANAGED. You can set controlModel to ORGANIZATION_CONTROLLED or CONTO_MANAGED. The selection is fixed for the new wallet; changing the organization default never migrates an existing wallet.

​

Managed Control Models

For organization-controlled creation, an organization owner first registers a base64 SPKI P-256 public key in Settings → Wallet Control and keeps the matching private key in the customer’s own key manager. Conto never receives or stores that private key. Privy creates the customer-only owner quorum and attaches Conto separately as an additional signer. The provider-level baseline policy is currently Ethereum/EVM-specific. Organization-controlled Solana creation is unavailable until a separately validated Solana signer policy is configured, so Conto is never attached as an unpolicied additional signer. Conto stores the wallet address, its public control model, and provider references needed for operations. Provider IDs and authorization secrets are not returned by the customer wallet API. An organization Owner can use Wallets → wallet menu → Export encrypted key. The owner signs the prepared request outside Conto, and Conto returns only HPKE ciphertext encrypted to a separate customer-provided recipient public key. See Exporting Wallet Keys.

​

External / Watch-Only Wallets

When you import a wallet, Conto registers it in EXTERNAL mode. You keep the keys, and your agent or wallet stack signs the transaction.

• Conto can still evaluate policies before the transfer.
• Conto can still require approval, record the payment, and keep the audit trail.
• The agent uses the approve -> transfer -> confirm flow.
• Conto cannot cryptographically block a direct transfer signed outside Conto.

You can register an external wallet directly with custodyMode=EXTERNAL plus address, or use the watch-only import flow in the dashboard. That means external wallets are best described as self-custody with policy gating, not as fully Conto-controlled execution.

​

Smart Contract Wallets

Smart contract wallets are the strongest enforcement option.

• Funds stay in an onchain contract wallet.
• Transfers require the approved contract path and Conto’s signature.
• This gives you cryptographic enforcement without giving Conto direct key custody.

​

Which Flow Should My Agent Use?

​

How To Choose

• Pick Organization-controlled managed if you need customer root administration or an export path while keeping Conto as the normal signer after Conto policies and approvals.
• Pick Conto-managed if you want Conto to remain the only product signing path and do not need customer self-service export.
• Pick External if you already have a wallet stack, MPC signer, or agent-held wallet and want to keep that setup.
• Pick Smart Contract if you want the strongest onchain enforcement model.

​

Related Guides