Skip to main content

​
Exporting Wallet Keys

Organization owners can export the private key for an ORGANIZATION_CONTROLLED managed wallet. The export is owner-authorized and end-to-end encrypted: Conto relays the signed request and returns HPKE ciphertext, but never receives the customer owner private key, the HPKE recipient private key, or the plaintext wallet key. This flow is not available for CONTO_MANAGED wallets. The control model is fixed when a wallet is created.

​
Before You Start

You need two customer-controlled P-256 keys with different purposes:
  1. The owner authorization key registered in Settings → Wallet Control. Keep its private half in your KMS or offline signing environment.
  2. A new HPKE recipient key for this export. Keep its private half outside Conto; Conto receives only its base64 SPKI public key.
Anyone with the decrypted wallet key can sign outside Conto and bypass Conto policies. Treat the export as a high-risk governance action and secure the resulting key accordingly.

​
Export From The Dashboard

  1. Sign in as the organization Owner.
  2. Open Wallets, open the organization-controlled wallet menu, and select Export encrypted key.
  3. Paste the HPKE recipient public key and choose Prepare owner authorization.
  4. Copy and base64-decode the authorization payload. Sign the decoded bytes outside Conto with the registered owner authorization private key using ECDSA P-256 with SHA-256 and DER encoding.
  5. Paste the base64 DER signature and download the encrypted export before the displayed expiry.
  6. Decrypt ciphertext using encapsulatedKey, the HPKE recipient private key, and this suite: DHKEM(P-256, HKDF-SHA256) / HKDF-SHA256 / ChaCha20-Poly1305.
For a base64 PKCS8 owner authorization private key, this Node.js snippet produces the signature the dialog expects:
The downloaded JSON is deliberately encrypted and is never persisted by Conto. A successful export marks the wallet’s key-access status as exported and writes an audit event, without storing the ciphertext or plaintext. Conto records an export intent before contacting the provider. If the provider response or the final audit write is ambiguous, keyAccess becomes EXPORT_RECONCILIATION_REQUIRED; another export is blocked until Conto reconciles the provider’s durable export timestamp.

​
Operational Boundaries

  • The owner authorization payload is bound to the provider wallet, recipient public key, request body, Conto app ID, and a ten-minute expiry.
  • Only an authenticated organization Owner can prepare or submit an export.
  • Conto’s additional-signer key cannot authorize export or administer the customer owner quorum.
  • Conto can continue signing through its normal policy and approval path after export, but the exported key also permits signing outside Conto.
See Custody Modes for the broader control and enforcement comparison.