> ## Documentation Index
> Fetch the complete documentation index at: https://conto.finance/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Credential scopes

> Standard and admin agent-key presets and the operations they authorize.

Both presets use agent SDK keys. Standard is the default. Admin adds delegated writes and
management access; it is not an organization API key for `ContoAdmin`.

## Agent key presets

| Scope                  | Standard | Admin | Operation                                                        |
| ---------------------- | -------- | ----- | ---------------------------------------------------------------- |
| `payments:request`     | Yes      | Yes   | Request authorization and protocol pre-authorization             |
| `payments:execute`     | Yes      | Yes   | Execute approved managed payments and record x402/MPP settlement |
| `payments:approve`     | Yes      | Yes   | Authorize an external-wallet payment                             |
| `payments:confirm`     | Yes      | Yes   | Confirm an externally executed payment                           |
| `wallets:read`         | Yes      | Yes   | Read wallets, spending limits, and budget requests               |
| `policies:read`        | Yes      | Yes   | Read assigned policies                                           |
| `transactions:read`    | Yes      | Yes   | Read transactions and payment status                             |
| `counterparties:read`  | Yes      | Yes   | Read counterparty relationships                                  |
| `alerts:read`          | Yes      | Yes   | Read alerts                                                      |
| `agents:read`          | Yes      | Yes   | Read the agent and setup summary                                 |
| `analytics:read`       | Yes      | Yes   | Read analytics and protocol budget/service summaries             |
| `network:read`         | Yes      | Yes   | Read network trust                                               |
| `audit:read`           | No       | Yes   | Read audit logs                                                  |
| `alerts:write`         | No       | Yes   | Respond to alerts                                                |
| `transactions:write`   | No       | Yes   | Request an eligible failed transaction retry                     |
| `counterparties:write` | No       | Yes   | Create and update counterparties                                 |
| `merchant-gates:read`  | No       | Yes   | Read merchant gates                                              |
| `merchant-gates:write` | No       | Yes   | Manage merchant gates                                            |
| `merchant:purchase`    | No       | Yes   | Use merchant purchase authorization                              |
| `policies:exceptions`  | No       | Yes   | Manage delegated policy exceptions                               |
| `agents:write`         | No       | Yes   | Manage delegated agent resources                                 |
| `wallets:write`        | No       | Yes   | Manage delegated wallet resources                                |
| `policies:write`       | No       | Yes   | Manage delegated policies                                        |

The scope authorizes access to an operation; wallet permissions, policies, approvals, and
resource ownership still apply. Neither preset grants team management, organization settings,
or the organization `admin` super-scope.

x402 and MPP recording require `payments:execute`, not `transactions:write`.
Use a standard key for those protocol flows. An admin key cannot create another admin SDK key.

## Choose and rotate a key

See [Authentication](/docs/sdk/authentication) for creating, expiring, and revoking keys.
Use [Admin SDK](/docs/sdk/admin) with an organization key for organization-wide provisioning.