Skip to main content
Your application code can stay the same between sandbox and production. Complete the checks below before you fund a live wallet. Conto is a hosted service. If you need a dedicated environment, a particular region, or private connectivity, contact Conto before implementation.

​
1. Ownership and custody

  • Record the production owner for the Conto organization, each agent, and each funded wallet.
  • Select and document managed, external, or smart-contract custody for every payment path.
  • Confirm who can fund, freeze, and unfreeze each wallet.
  • Start with a deliberately small live balance and transaction limit.
  • Move off the anonymous sandbox to a full account. Sandbox organizations are simulated and expire.
  • Check your plan’s agent, monthly transaction, and payment-value limits in Settings > Plan & Usage.

​
2. Credentials

  • Create separate sandbox and production keys. Never promote a sandbox secret.
  • Grant only the scopes the runtime needs.
  • Store secrets in a secret manager, not in source files or CI output.
  • Test key expiry, rotation, revocation, and emergency access removal.
  • Log Conto request IDs without logging credentials or full sensitive payloads.

​
3. Policy and approvals

  • Configure per-transaction, daily, and monthly spend limits.
  • Configure counterparty, category, geography, and time-window rules where applicable.
  • Route exceptions to named approvers and test unavailable-approver behavior.

​
4. Verify the integration

Test allow, review, and deny builds the first four cases.
  • From the buyer runtime, run an allowed payment, an over-budget refusal, a prohibited recipient, and a request that waits for owner approval.
  • Confirm refused and unresolved requests never sign, submit credentials, or reach payment execution.
  • Change the transaction after approval and confirm that the executor refuses the old authorization.

​
5. Safe payment execution

  • Supply and persist a stable idempotency key for authorization and record writes that support one.
  • Retry a mutating request only when its API supports idempotency and you reuse the same key.
  • Never automatically retry payment execution or confirmation. Reconcile the known payment status first.
  • Treat timeouts and network disconnects as ambiguous until payment status is reconciled.
  • Exercise insufficient-funds, rate-limit, policy-denial, and provider-outage paths.
  • Reconcile Conto payment IDs, provider references, and onchain transaction hashes.

​
6. Webhooks and downstream systems

  • Verify signatures against the unmodified request body.
  • Reject stale X-Conto-Timestamp values and deduplicate on X-Conto-Delivery-Id.
  • Return success only after durable receipt or queueing.
  • Test retries, out-of-order events, and duplicate delivery. Conto stops after three failed attempts, so reconcile missed events through the REST API.
  • Document whether ERP, accounting, and CRM connections use your webhook consumer or the REST API. Do not assume a native connector.

​
7. Monitoring and incident response

  • Monitor payment failure rate, approval backlog, wallet balance, and webhook lag.
  • Alert on repeated policy denials, credential failures, and reconciliation gaps.
  • Test freezing and unfreezing an agent, and record who may do it.
  • Record primary and backup incident contacts for your team and for Conto support.
  • Rehearse disabling keys, stopping payment execution, and restoring service safely.

​
8. Go-live evidence

  • Capture the approved policy configuration and test results.
  • Capture credential scopes and rotation date without storing secret values.
  • Capture webhook retry and reconciliation test results.
  • Record the initial funding cap and expansion criteria.
  • Obtain explicit authorization from the wallet and business owners to enable live funds.

​
Moving to production

Fund the live wallet only after every applicable item has an owner and evidence. Then:
  1. Create a production wallet on a supported network: Tempo Mainnet (USDC.e), Base (USDC), or Solana (USDC).
  2. Fund it with real stablecoins, starting with the small balance you recorded.
  3. Link it to your agent with production limits.
  4. Set the agent’s environment to PROD. Open the agent in Agents, go to the Identity tab, choose Edit Identity, and set Environment to Production. From code, send PATCH /api/agents/{id} with {"environment": "PROD"} using an organization API key with agents:write. DEV and STAGING agents can pay only from testnet wallets.
  5. Adjust policies for production thresholds. Your testnet wallet and test policies can stay active alongside production.
  6. Expect a production agent’s first payment to each new payee to return REQUIRES_APPROVAL for counterparty review.
Expand limits in stages after reviewing real payment, approval, webhook, and reconciliation behavior.