Wallet custody

1. Custody. Who can sign the transfer?
2. Enforcement. Can Conto actually stop the transfer, or only govern the path that goes through Conto?

​

Quick comparison

​

What policies mean in each mode

​

Managed wallets

• Conto evaluates the payment.
• If approved, Conto orchestrates execution.
• If denied, the payment does not execute through Conto.
• The agent calls POST /api/sdk/payments/request, then POST /api/sdk/payments/{id}/execute, or passes autoExecute: true on the request.

​

Managed control models

• Your organization’s owner key is the root owner. Only your organization holds it.
• Conto is a separate signer and signs only after your policies and approvals pass. On EVM, the wallet provider also limits what Conto’s signer can do.
• Your owner can manage the wallet and approve a key export.
• Conto cannot stop everything. The owner key can authorize actions outside Conto, and an exported key can sign outside Conto.

• A Conto authorization key is the root owner.
• Conto is the only signer and signs only after your policies and approvals pass.
• There is no self-service key export.
• There is no customer signing path outside Conto.

​

External (watch-only) wallets

• Conto can still evaluate policies before the transfer.
• Conto can still require approval, record the payment, and keep the audit trail.
• The agent calls POST /api/sdk/payments/approve, sends the transfer with its own signer or wallet, then calls POST /api/sdk/payments/{id}/confirm.
• Conto cannot cryptographically block a direct transfer signed outside Conto.

​

How to choose

• Pick Organization-controlled managed if you need customer root administration or an export path while keeping Conto as the normal signer after Conto policies and approvals.
• Pick Conto-managed if you want Conto to remain the only product signing path and do not need customer self-service export.
• Pick External if you already have a wallet stack, MPC signer, or agent-held wallet and want to keep that setup.

​

Export a wallet key

​

Before you start

1. The owner authorization key registered in Settings → Wallet Control. Keep its private half in your KMS or offline signing environment.
2. A new HPKE recipient key for this export. Keep its private half outside Conto. Conto receives only its base64 SPKI public key.

​

Export from the dashboard

1. Sign in as the organization Owner.
2. Open Wallets, open the organization-controlled wallet menu, and select Export encrypted key.
3. Paste the HPKE recipient public key and choose Prepare owner authorization.
4. Copy and base64-decode the authorization payload. Sign the decoded bytes outside Conto with the registered owner authorization private key using ECDSA P-256 with SHA-256 and DER encoding.
5. Paste the base64 DER signature and download the encrypted export before the displayed expiry.
6. Decrypt ciphertext using encapsulatedKey, the HPKE recipient private key, and this suite: DHKEM(P-256, HKDF-SHA256) / HKDF-SHA256 / ChaCha20-Poly1305.

import { createPrivateKey, sign } from 'node:crypto';

const payload = Buffer.from(process.env.CONTO_AUTHORIZATION_PAYLOAD!, 'base64');
const ownerKey = createPrivateKey({
  key: Buffer.from(process.env.CONTO_OWNER_PRIVATE_KEY!, 'base64'),
  format: 'der',
  type: 'pkcs8',
});

const signature = sign('sha256', payload, ownerKey).toString('base64');
console.log(signature);

​

Operational boundaries

• The authorization payload covers this wallet, this recipient key, and this request, and expires after 10 minutes.
• Only an authenticated organization Owner can prepare or submit an export.
• Conto’s additional-signer key cannot authorize export or administer the customer owner quorum.
• Conto can continue signing through its normal policy and approval path after export, but the exported key also permits signing outside Conto.

​

Related guides