Skip to main content
Stripe Link is Stripe’s payment wallet. Conto’s integration with Stripe Link checks an agent’s Link purchase against the owner’s rules before Link is used and again right before the agent pays. The buyer pays with their own Link account. Nobody connects Link to Conto, and Conto does not receive the card number. Both paths rely on your trusted runtime to call Conto and follow its answer, and Conto records the outcome your checkout reports. For a check at the moment of payment, use a connected card. Start with the demo, then add the checkpoints to your buyer runtime.

Try the approval flow

Open the Stripe Link demo and choose Start agents. Three agents in one demo organization shop a fictional catalog with Stripe test checkout, so no payment details are needed. They share a supplier policy, and each has its own budget.
  • Office buys a $39 laptop stand that passes Conto.
  • Equipment buys a $349 monitor that waits for review. Choose Approve $349.00 or Deny on its card. After approval, follow Continue to Link → into Stripe’s test checkout and stop before payment.
  • Events buys a $79 coffee maker that is blocked until its purchasing window opens. Choose Fix policy, set Purchasing dates · UTC to Any time, then choose Save purchase rules and Retry purchase. Approval rules still apply.
To see a category block, open More on Office’s card and choose Try a coffee maker. More → Run again restores the laptop stand. Shopping chat on an agent’s card changes its cart in conversation. In the demo you act as the reviewer, and its limits differ from the starter limits below. In your integration, only the organization’s authorized reviewers can approve. The demo makes its final check when it opens Link. For an agent that also presses Pay, add the second checkpoint immediately before that action.

Manage several agents

Set spend limits and store restrictions for each agent, and apply organization policies or reusable assigned policies across agents. All applicable policies must pass. A reused policy applies the same rules to each agent but no shared limit. For one limit across agents, use a shared budget, which counts checkpoint and checkout.getLinkCard() purchases. Daily, weekly, and monthly agent or organization limits count held and paid checkout spend with the agent’s wallet and card spend. See checkout purchases. A review approval does not override a hard cap. With a $1,000 monthly budget and $800 already spent, a $450 request is denied before Link opens, even under a $500 per-purchase limit. The budget holder must change the policy before a retry.
  • Stores. Allowlists and blocklists match the checkout domain, not the merchant name the agent sends. See the merchant is the checkout domain.
  • Categories. Pass a category such as EQUIPMENT from trusted checkout configuration, never from the model. Conto evaluates the category you send and does not check it against a merchant category code. Without one, a Link checkpoint uses STRIPE_LINK.
  • No review needed. A purchase that passes with no review requirement continues automatically. Link’s own authorization still applies.
When a policy holds a checkout for review, the organization’s approval workflow picks the reviewers: named members or roles, multiple or ordered approvals, and expiry or escalation. Set it in Policies → Approvers, through the workflow API, or with the Conto assistant. With no matching workflow, an Owner, Admin, or Manager decides. A workflow does not hold a checkout by itself, so configure a policy that requires review for the purchases you want routed. Decide held purchases in Inbox. Each checkout appears in Transactions and on the agent’s Activity tab. A request blocked before a checkout was created shows there as Blocked by policy, and in Audit logs, with no payment or hold.

Set up the agents together

Give each runtime its own agent and standard SDK key, generated on the agent’s Connect tab. Runtimes that share a key act as one agent for policy and spending records. Assign one supplier policy with the approved checkout domains to all the agents, and give each agent its own spend and review policies. Organization policies still apply, and the starter limits below stop larger purchases until the budget holder changes them. A less restrictive agent policy never overrides a stricter organization policy.

Link’s own authorization

Conto policies are configured in Conto, separately from Link’s account limits and any approval Link requires. Depending on the supported agent and checkout, Link approval can happen in agent chat, at merchant checkout, or through Link’s website or app. Conto does not bypass those requirements or set Link’s limits.

Add the checkpoints

You need access to the buyer’s checkout runtime, an agent and its standard SDK key, and a supported Link checkout. Create the agent in the dashboard, then choose Generate SDK key on its Connect tab. Keep the key in server-side configuration, outside model input and browser code. Creating a Conto account does not connect or modify your existing checkout automatically. Use SDK 0.8.2 or later. Checkpoints support USD only, and amountMinor and item prices are integer cents.
For a copy-and-run starting point, download the Link controls starter. Unzip it, open the conto-link-controls folder, and run npm ci --ignore-scripts. Follow its README to configure your test agent and Link sign-in. It includes npm run doctor for local setup checks and a test-card verification that cancels the unused Link card and then the checkpoint, so nothing stays held. Its README walks through allowed, review-required, and blocked purchases. It never opens a merchant checkout or pays.
The example assumes your runtime supplies order, page, and a trusted checkout adapter. openLink() opens the supported Link UI, and readFinalCart() independently reads all final items and charges. submitOnce() must recheck the cart, claim dispatch atomically for the original purchase ID, submit once, and durably save the observed outcome and non-sensitive reference before returning them. Use UNKNOWN for ambiguous submission, and return PAID only with purchase evidence. If reporting fails, retry from the saved outcome without submitting again. The SDK does not operate the browser or provide these adapter methods. If begin() or confirm() throws, stop the checkout and do not pay. Read the actual final items and charges in your trusted checkout code and pass them to confirm(). A same-price item substitution also requires fresh authorization. checkoutMethod defaults to LINK, so a Link checkout can leave it out. checkoutUrl is the store’s checkout page. Conto names the merchant by its domain. See the merchant is the checkout domain. Reuse the same idempotencyKey when you retry begin(). If you know the checkpoint ID after a timeout, read it with conto.checkout.get(id) before continuing. If the first begin() response never arrived, retry begin() with the same key to recover the same checkpoint. Your executor must claim payment dispatch once per purchase: a replayed confirmation is not permission to submit payment twice. If outcome reporting fails after payment, reconcile and retry the report. Do not submit payment again. Checkout checkpoints covers every stage, the HTTP endpoints, and the MCP tools. Download the checkpoint example and import prepareLinkPayment into your trusted runtime. Pass it the same conto, purchase (the input to begin()), and checkout adapter shown above. It calls openLink() and readFinalCart() and returns { checkpoint, finalCart } for your executor’s submitOnce(). It does not drive the browser, submit payment, or verify settlement. If review times out or the cart keeps changing, keep the checkpoint so you can resume it or cancel the unused hold. Do not restart an uncertain payment.

When a purchase needs approval

New organizations start with $25 per transaction, $100 a day, and approval above $10, so the $15 purchase above waits for review. See starter guardrails. begin() then returns AWAITING_APPROVAL, and Conto holds the $15 against the agent’s limits. The organization’s approval workflow picks the reviewers. With no matching workflow, an Owner, Admin, or Manager decides. Do not open Link while the checkpoint waits. After approval the agent has 30 minutes to confirm. A rejection or an expired request makes waitForApproval() throw and releases the hold. waitForApproval() polls for 10 minutes by default. Its CheckoutApprovalTimeoutError leaves the hold in place, so wait again with the error’s checkpoint or cancel it. When the final total changes, confirm() cancels the old checkpoint and checks a new one at that total, and throws CheckoutApprovalPendingError with the new checkpoint if it needs review. Wait for that checkpoint’s approval, read the final cart again, and confirm the returned checkpoint before paying. A same-price item substitution needs a new purchase: cancel the checkpoint and call begin() with the changed items and a new idempotency key. See checkout checkpoints for stages and options. With a Stripe Link card, follow when the total changes instead, because the card covers only its approved amount.

Test without a live purchase

The demo runs in Stripe test mode. For your own checkout, use the merchant’s Stripe test environment. A Conto checkpoint does not turn a live merchant page into a sandbox. Without a test environment, inspect the Conto decision and stop before opening or submitting a live payment. If your agent requests a card through Link CLI, use linkCliWallet({ test: true }). That is a separate test-card path, not a setting on the checkpoint client or a way to switch an arbitrary merchant checkout into test mode. Conto still records the test requests and counts their holds against the configured agent’s limits, so use dedicated test agents. Never report PAID when you stopped before payment.

Report the outcome

After the agent pays, report PAID, NOT_PAID, or UNKNOWN on the confirmed checkpoint. See report the outcome for what each keeps held. To stop before confirm(), cancel the checkpoint with conto.checkout.cancel(). If a Stripe Link card was requested for it, cancel the Link request with wallet.cancel() first, because the checkpoint cancel releases the hold while the card can still work for up to 48 hours. See Stripe Link cards for agents.

What the owner sees

Held purchases appear in Inbox, and each checkout appears in Transactions with its steps. When a confirmed checkout has no outcome, the owner gets an alert, and an Owner, Admin, or Manager chooses Mark as paid or Mark as not paid on its page. See what the owner sees.