Skip to main content
Connect a card and verify its authorization first. Use an SDK version with conto.connectedCards and an agent key with transactions:read for listing and payments:approve for requests and acknowledgment. See authentication.

Request and use a credential

Call conto.connectedCards.list() to find the agent’s masked cards and mandates, then select the card and verified mandate for your purchase. A credential request is called a draw. Use a stable 8–128 character idempotency key per draw. Amounts are in USD cents: 2500 means $25.00.
completeAuthorizedCheckout is your application’s function. It must use the authorized merchant and checkout origin, enforce the purchase amount, and prevent duplicate checkout. Never persist credentials or expose them in prompts, tool results, logs, traces, or screenshots.

Decisions and retries

Credentials are returned only once. The SDK does not automatically retry draw(), and reusing a key cannot retrieve a lost credential. Do not generate a new key to recover an uncertain result. Issued allowance capacity remains consumed even if checkout fails. acknowledgeDelivery() is safe to retry for the same request. It records receipt of the credential, not payment settlement. Keep the request ID and non-sensitive order references, and confirm the purchase against the merchant receipt and card activity. Contact support if the outcome remains unclear.

HTTP endpoints

Use bearer authentication. Match the verified mandate’s merchant details; optional merchant fields include merchantId, merchantCategory (four-digit MCC), and merchantCountry (two- or three-letter code).