Both paths rely on your trusted runtime to call Conto and follow its answer, and Conto records the outcome your checkout reports. For a check at the moment of payment, use a connected card.
Start with the demo, then add the checkpoints to your buyer runtime.
Try the approval flow
Open the Stripe Link demo and choose Start agents. Three agents in one demo organization shop a fictional catalog with Stripe test checkout, so no payment details are needed. They share a supplier policy, and each has its own budget.- Office buys a $39 laptop stand that passes Conto.
- Equipment buys a $349 monitor that waits for review. Choose Approve $349.00 or Deny on its card. After approval, follow Continue to Link → into Stripe’s test checkout and stop before payment.
- Events buys a $79 coffee maker that is blocked until its purchasing window opens. Choose Fix policy, set Purchasing dates · UTC to Any time, then choose Save purchase rules and Retry purchase. Approval rules still apply.
Manage several agents
Set spend limits and store restrictions for each agent, and apply organization policies or reusable assigned policies across agents. All applicable policies must pass. A reused policy applies the same rules to each agent but no shared limit. For one limit across agents, use a shared budget, which counts checkpoint andcheckout.getLinkCard() purchases. Daily, weekly, and monthly agent or organization limits count held and paid checkout spend with the agent’s wallet and card spend. See checkout purchases.
A review approval does not override a hard cap. With a $1,000 monthly budget and $800 already spent, a $450 request is denied before Link opens, even under a $500 per-purchase limit. The budget holder must change the policy before a retry.
- Stores. Allowlists and blocklists match the checkout domain, not the merchant name the agent sends. See the merchant is the checkout domain.
- Categories. Pass a
categorysuch asEQUIPMENTfrom trusted checkout configuration, never from the model. Conto evaluates the category you send and does not check it against a merchant category code. Without one, a Link checkpoint usesSTRIPE_LINK. - No review needed. A purchase that passes with no review requirement continues automatically. Link’s own authorization still applies.
Set up the agents together
Give each runtime its own agent and standard SDK key, generated on the agent’s Connect tab. Runtimes that share a key act as one agent for policy and spending records. Assign one supplier policy with the approved checkout domains to all the agents, and give each agent its own spend and review policies. Organization policies still apply, and the starter limits below stop larger purchases until the budget holder changes them. A less restrictive agent policy never overrides a stricter organization policy.Link’s own authorization
Conto policies are configured in Conto, separately from Link’s account limits and any approval Link requires. Depending on the supported agent and checkout, Link approval can happen in agent chat, at merchant checkout, or through Link’s website or app. Conto does not bypass those requirements or set Link’s limits.Add the checkpoints
You need access to the buyer’s checkout runtime, an agent and its standard SDK key, and a supported Link checkout. Create the agent in the dashboard, then choose Generate SDK key on its Connect tab. Keep the key in server-side configuration, outside model input and browser code. Creating a Conto account does not connect or modify your existing checkout automatically. Use SDK 0.8.2 or later. Checkpoints support USD only, andamountMinor and item prices are integer cents.
conto-link-controls folder, and run npm ci --ignore-scripts.
Follow its README to configure your test agent and Link sign-in. It includes npm run doctor for local setup checks and a test-card verification that
cancels the unused Link card and then the checkpoint, so nothing stays held. Its README walks through allowed,
review-required, and blocked purchases. It never opens a merchant checkout or pays.
order, page, and a trusted checkout
adapter. openLink() opens the supported Link UI, and readFinalCart() independently
reads all final items and charges. submitOnce() must recheck the cart, claim dispatch
atomically for the original purchase ID, submit once, and durably save the observed
outcome and non-sensitive reference before returning them. Use UNKNOWN for ambiguous
submission, and return PAID only with purchase evidence. If reporting fails, retry from
the saved outcome without submitting again. The SDK does not operate the browser or
provide these adapter methods.
If begin() or confirm() throws, stop the checkout and do not pay. Read the actual final items and charges
in your trusted checkout code and pass them to confirm(). A same-price item substitution
also requires fresh authorization.
checkoutMethod defaults to LINK, so a Link checkout can leave it out. checkoutUrl is the
store’s checkout page. Conto names the merchant by its domain. See
the merchant is the checkout domain.
Reuse the same idempotencyKey when you retry begin(). If you know the checkpoint ID after a timeout, read it with
conto.checkout.get(id) before continuing. If the first begin() response never arrived,
retry begin() with the same key to recover the same checkpoint. Your executor must
claim payment dispatch once per purchase: a replayed confirmation is not permission to
submit payment twice. If outcome reporting fails after payment, reconcile and retry the
report. Do not submit payment again.
Checkout checkpoints covers every stage, the HTTP endpoints, and
the MCP tools.
Download the checkpoint example and import prepareLinkPayment into your trusted runtime. Pass it the same conto, purchase (the input to begin()), and checkout adapter shown above. It calls openLink() and readFinalCart() and returns { checkpoint, finalCart } for your executor’s submitOnce(). It does not drive the browser, submit payment, or verify settlement. If review times out or the cart keeps changing, keep the checkpoint so you can resume it or cancel the unused hold. Do not restart an uncertain payment.
When a purchase needs approval
New organizations start with $25 per transaction, $100 a day, and approval above $10, so the $15 purchase above waits for review. See starter guardrails.begin() then returns AWAITING_APPROVAL, and Conto holds the $15 against the agent’s limits. The organization’s approval workflow picks the reviewers. With no matching workflow, an Owner, Admin, or Manager decides. Do not open Link while the checkpoint waits. After approval the agent has 30 minutes to confirm. A rejection or an expired request makes waitForApproval() throw and releases the hold.
waitForApproval() polls for 10 minutes by default. Its CheckoutApprovalTimeoutError leaves the hold in place, so wait again with the error’s checkpoint or cancel it.
When the final total changes, confirm() cancels the old checkpoint and checks a new one at that total, and throws CheckoutApprovalPendingError with the new checkpoint if it needs review. Wait for that checkpoint’s approval, read the final cart again, and confirm the returned checkpoint before paying. A same-price item substitution needs a new purchase: cancel the checkpoint and call begin() with the changed items and a new idempotency key. See checkout checkpoints for stages and options. With a Stripe Link card, follow when the total changes instead, because the card covers only its approved amount.
Test without a live purchase
The demo runs in Stripe test mode. For your own checkout, use the merchant’s Stripe test environment. A Conto checkpoint does not turn a live merchant page into a sandbox. Without a test environment, inspect the Conto decision and stop before opening or submitting a live payment. If your agent requests a card through Link CLI, uselinkCliWallet({ test: true }).
That is a separate test-card path, not a setting on the checkpoint client or a way to
switch an arbitrary merchant checkout into test mode. Conto still records the test
requests and counts their holds against the configured agent’s limits, so use dedicated
test agents. Never report PAID when you stopped before payment.
Report the outcome
After the agent pays, reportPAID, NOT_PAID, or UNKNOWN on the confirmed checkpoint. See report the outcome for what each keeps held. To stop before confirm(), cancel the checkpoint with conto.checkout.cancel(). If a Stripe Link card was requested for it, cancel the Link request with wallet.cancel() first, because the checkpoint cancel releases the hold while the card can still work for up to 48 hours. See Stripe Link cards for agents.