Skip to main content

Admin SDK

Use ContoAdmin for organization-level automation: provisioning agents, attaching wallets, assigning policies, and creating agent SDK keys. Use the regular Conto client for agent runtime payment calls.

Initialize

Create organization API keys from Settings > API Keys. Store them in a secret manager and use the smallest scope preset that can perform the job.

Provision an agent

This is the common backend setup flow:
The returned SDK key is shown once. Pass it to the agent runtime as CONTO_API_KEY. ORGANIZATION_CONTROLLED requires the organization owner to register its public authorization key in Settings → Wallet Control first. Use CONTO_MANAGED when customer self-service key export is not required. Wallet responses return controlModel and keyAccess so provisioning systems can reconcile the selected boundary without receiving provider IDs. Organization-controlled creation is currently EVM-only until a validated Solana provider policy is configured. If keyAccess is EXPORT_RECONCILIATION_REQUIRED, fail closed and wait for provider reconciliation before attempting another export. Agent responses include the caller-owned externalId, parsed allowedContexts, the owner’s stable membership reference, and callback configuration so provisioning systems can reconcile what Conto stored. Callback query and fragment values are redacted in responses; send callbackUrl again when rotating a callback token. agents.list({ search }) also matches externalId. The setup field reports READY or ACTION_REQUIRED with normalized issues and the request field to update. It is intended for customer setup automation; provider state and arbitrary agent metadata are not returned. linkedWalletCount and transactionCount provide stable list-level reconciliation counts without exposing database relation objects.

Method map

Policy version history

Every change to a policy is versioned. Review the history, diff two versions, and roll back.

Scopes

Admin SDK methods use organization API key scopes. Read methods need the matching *:read scope. Create, update, delete, link, assign, provision, freeze, and revoke methods need the matching *:write or admin scope. See Authentication for key creation and rotation.

Security notes

  • Organization keys can manage all agents and wallets in the organization.
  • Prefer scoped keys for CI and provisioning jobs.
  • Rotate keys regularly and revoke unused keys.
  • Billing plan changes are available only to owners in the dashboard; organization API keys cannot change billing plans.

Authentication

Key types, scopes, and rotation

Payments

Agent runtime payment calls

Policies

Policy types and evaluation behavior

API Reference

OpenAPI and REST reference links