conto.connectedCards and an agent key with transactions:read for listing and payments:approve for requests and acknowledgment. See authentication.
Request and use a credential
Callconto.connectedCards.list() to find the agent’s masked cards and mandates, then select the card and verified mandate for your purchase. A credential request is called a draw. Use a stable 8–128 character idempotency key per draw. Amounts are in USD cents: 2500 means $25.00.
completeAuthorizedCheckout is your application’s function. It must use the authorized merchant and checkout origin, enforce the purchase amount, and prevent duplicate checkout. Never persist credentials or expose them in prompts, tool results, logs, traces, or screenshots.
Decisions and retries
Credentials are returned only once. The SDK does not automatically retry
draw(), and reusing a key cannot retrieve a lost credential. Do not generate a new key to recover an uncertain result. Issued allowance capacity remains consumed even if checkout fails.
acknowledgeDelivery() is safe to retry for the same request. It records receipt of the credential, not payment settlement. Keep the request ID and non-sensitive order references, and confirm the purchase against the merchant receipt and card activity. Contact support if the outcome remains unclear.
HTTP endpoints
Use bearer authentication. Match the verified mandate’s merchant details; optional merchant fields include
merchantId, merchantCategory (four-digit MCC), and merchantCountry (two- or three-letter code).