Skip to main content
Use ContoAdmin for organization-level automation: provisioning agents, attaching wallets, assigning policies, and creating agent SDK keys. Use the Conto client for agent runtime payment calls. ContoAdmin takes an organization API key (conto_...), never an agent SDK key. See authentication for the key types.

Initialize

Create and rotate organization API keys in Settings > API Keys. Store them in a secret manager and use the smallest scope preset that can do the job.

Provision an agent

The returned SDK key is shown once. Pass it to the agent runtime as CONTO_API_KEY. The example uses CONTO_MANAGED. ORGANIZATION_CONTROLLED wallets are EVM only and need the owner’s public authorization key registered in Settings > Wallet Control first. Use CONTO_MANAGED when the owner does not need to export the key. If keyAccess is EXPORT_RECONCILIATION_REQUIRED, wait before attempting another export. agents.list({ search }) also matches externalId. Callback query and fragment values are redacted in responses, so send callbackUrl again when rotating a callback token. Each agent’s setup field reports READY or ACTION_REQUIRED and names the field to update.

Method map

Policy version history

Every change to a policy is versioned. Review the history, diff two versions, and roll back.

Scopes

Read methods need the matching *:read scope. Create, update, delete, link, assign, provision, freeze, and revoke methods need the matching *:write or admin scope.

Security notes

  • Organization keys can manage all agents and wallets in the organization.
  • Prefer scoped keys for CI and provisioning jobs.
  • Rotate keys regularly and revoke unused keys.
  • Only owners change billing plans, in the dashboard. Organization API keys cannot change them.