​

Conto Pay

Conto Pay is the hosted way to run agentic payments in Conto. Instead of wiring your own runtime, wallet, and approval flow, Conto provisions a managed payment agent workspace for you and exposes it through the dashboard and assistant. The hosted workspace now behaves like an operator console, not just a payment form. You can share a named Conto Pay profile, create tracked checkout links, check wallet readiness, refresh balances, request Tempo sandbox funds, inspect payment state, retry failed payments, and tune hosted controls directly from chat.

​

Paying Any Wallet, And The Conto Network

Conto Pay agents can pay any wallet address you add as an approved recipient. Every payment follows the same hosted draft, authorization, approval, and send path, whether or not the payee is on Conto Pay. When the payee is another organization’s hosted Conto Pay workspace, you get more than an address. The workspace is added as a verified network recipient, so agents resolve it by name, confirm its identity, and get a trust review if its details later change. The target workspace can be resolved by:

• a Conto Pay handle such as @vendor-org or @vendor-org/accounts-payable
• the target account display name or public search aliases such as “Vendor AP”
• the target organization slug or organization name
• the target agent ID, agent slug, or agent name
• the target hosted wallet address

Once added, the recipient is stored in your normal Conto Pay allowlist as a verified CONTO_PAY_NETWORK counterparty. Operators do not need a separate workflow for network payments; they use the same assistant, draft, policies, approvals, and send actions as any other hosted payment.

​

Conto Pay vs AI Assistant vs MCP

Conto has three natural-language surfaces. They differ by who acts, how you reach them, and whether they move funds onchain:

​

What Makes It Different

​

What Conto Provisions

When you open Conto Pay, the workspace is created with:

• a Conto-managed payment agent
• a hosted wallet with readiness tracked in the workspace
• starter spend policies
• recipient allowlist controls
• an approval workflow
• a hosted profile URL and shareable Conto Pay handle
• durable hosted checkout links with status, expiry, open tracking, and cancellation controls
• hosted profile trust reports with submitter status pages, profile evidence snapshots, operator review controls, and directory-hide adjudication for reported profiles
• editable account names, descriptions, and public search aliases for easier agent discovery
• Conto Pay contacts with aliases, favorites, payment defaults, trust review, and payment controls for saved and recent agent payment identities
• a unified activity inbox for payments, requests, receipts, and next actions
• launch funnel insights for checkout-link opens, request preparation, authorization, send failures, and successful closed-loop sends
• launch-readiness evidence that Conto support can review before a customer cohort moves forward
• customer-triggered live-review requests that create a support-visible review item
• assistant actions for wallet refresh, payment inspection, retry, and cancellation
• network-recipient resolution for other hosted Conto Pay workspaces
• a pre-minted SDK key for optional later integration

The workspace starts in sandbox so teams can verify the experience with the same hosted control surface they will use when moving to approved live money. After sandbox evidence is ready, customers can request live review from the Activation card; Conto support enables live mode only for approved cohorts that pass the live rollout gate.

​

Wallet Readiness

Conto Pay does not show the workspace as ready just because the page exists. The hosted agent still needs a provisioned wallet and enough balance to operate safely.

• the workspace shows whether the hosted wallet is ready to send
• if the hosted wallet is not ready, the assistant can explain what is missing
• on Tempo testnet, the assistant can request sandbox pathUSD for the hosted wallet
• once funded, you can refresh the wallet balance from chat before authorizing a payment

The goal is to keep setup, funding, and payment execution inside the same Conto Pay workflow.

​

Profiles, Requests, And Receipts

Each hosted Conto Pay workspace has a stable profile identity, not just a wallet address.

​

Profile Identity

• your organization gets a Conto Pay handle such as @vendor-org or @vendor-org/accounts-payable
• operators can edit the public account name, description, and directory listing state from the Conto Pay console, and add public search aliases such as Vendor AP, Accounts Payable, or a team name so humans and agents can find the profile without knowing the exact handle
• the workspace exposes a hosted profile URL that other operators can open or copy directly
• the hosted profile shows public paymentMode, agent-readiness state, and the safe action status for profile verification, Pay, Request, and live-money presentation
• the hosted profile includes Pay and Request actions that generate copyable deep links with the current amount, memo, and invoice fields; shared profile links can be prefilled with mode, amount, purpose, and invoiceId, so a profile page can open directly as a lightweight pay or request checkout
• hosted profile pages include a rate-limited report flow for suspicious checkout links, stale profile details, spam, or impersonation concerns; submitters receive a /pay-report/{reportId} status page with customer-safe outcomes and next steps, while operators review, resolve, close, or hide reported profiles from broad directory search in the Conto Pay console

​

Profile API

• the hosted profile exposes a copyable Profile API URL such as /api/conto-pay/profiles/vendor-org/accounts-payable for agent-readable identity lookup
• the Profile API returns public identity metadata, verification signals, capabilities, settlement details, activation status, public live-review status, customer-safe rollout policy messaging, a compact agentReadiness contract, canonical Pay/Request links, structured action fields, and URL templates without exposing dashboard-only relationship state
• the Profile API includes a stable profile.integrity.fingerprint and cache ETag, so agents can compare the current public identity with a saved contact before preparing payment
• the Profile API includes profile.discovery.aliases, query examples, and an agent instruction so agents can explain how the account should be searched or referenced
• when a shared Profile API URL includes ?intent={intentId} (tracked checkout links embed this in their URLs so opens are recorded), the response includes a public checkoutIntent object with the link status, mode, amount, memo, invoice ID, expiry, open count, and cancellation state; tracked Profile API responses use fresh no-store responses so agents can see current link state before staging work

How agents should consume the Profile API (actions.pay / actions.request metadata, agentReadiness decisions, fingerprint caching, and directory handoffs) is covered in Sharing Your Hosted Profile.

​

Requests, Receipts, And Contacts

• hosted payment requests open in a review page at /pay-requests/{requestId} (see Hosted Payment Requests)
• direct Conto Pay payments expose a hosted status and receipt page at /pay-status/{paymentRequestId}
• the activity inbox keeps payments, requests, receipts, and next actions in one timeline, and the Conto Pay contacts list turns saved network recipients and recent request counterparties into reusable agent payment identities with aliases, favorites, defaults, payee-specific limits, and trust-snapshot warnings; unresolved contact trust warnings block saved-contact payment preparation until the operator reviews the current public profile

This matters because the hosted workflow no longer starts only from “enter a wallet and send.” Teams can share a profile, request payment, review a request, and refer back to the same hosted receipt without leaving Conto Pay.

​

How To Use Conto Pay

​

How Payments Are Initiated

Conto Pay is designed to behave like a hosted agent, so the assistant is the primary control surface. Everything from wallet readiness and recipient management through drafting, authorizing, approving, retrying, and sending happens through natural-language instructions, and Conto turns those operator instructions into the normal request, review, and execution flow rather than bypassing platform controls. For the full catalog of operator tasks with example prompts, see Common Tasks in Using the Assistant.

​

Hosted Controls

Conto Pay uses the normal Conto control model, but the hosted workspace exposes the most important operator controls directly in chat:

• recipient allowlists for who the hosted agent can pay
• approval thresholds for when human review is required
• wallet spend limits for per-transaction and daily controls
• payment inspection so operators can see whether a request is ready, waiting, failed, or blocked
• profile and checkout-link analytics so operators can see whether a shared checkout link was opened
• public Profile API rate limits to reduce scraping and request bursts
• trust-report review controls that can hide a reported profile from broad directory search while keeping direct profile links, exact-handle resolution, checkout-link status, and public report status pages available

This gives teams a managed surface without creating a separate rules engine or approval path.

​

Checkout Links

Checkout links are the lightweight handoff layer for humans and agents. They are useful when the recipient, amount, memo, or invoice details are already known, but the payer still needs to review and authorize the payment inside Conto Pay. Each checkout intent stores:

• whether it is a Pay link or Request link
• amount, currency, memo, and request-only invoice ID
• hosted profile URL and direct /conto-pay handoff URL
• profile API URL for agent-readable verification
• expiry and lifecycle status (ACTIVE, USED, EXPIRED, or CANCELLED)
• open count and last-opened timestamp
• cancellation timestamp when the operator cancels the link

Checkout links do not authorize or send money. Opening a link only preloads the hosted profile or assistant prompt. The payer still has to prepare the draft, authorize it, pass policy checks, and complete any required approval before funds move.

​

Hosted Payment Requests

Conto Pay is not limited to payer-initiated payments. A hosted workspace can also request payment from another hosted Conto Pay workspace. The normal pattern is:

1. Share your Conto Pay handle or hosted profile URL.
2. The payee creates a hosted request with amount, purpose, and optional invoice details.
3. Conto creates a hosted review page at /pay-requests/{requestId} for the payer.
4. The payer prepares that request into their current Conto Pay draft.
5. The payer still authorizes, approves, and sends using the normal hosted controls.

Preparing a request never bypasses policy evaluation. It only stages the payer, amount, and purpose inside the hosted draft so the normal approval path can continue.

​

Activity Inbox And Receipts

The hosted workspace now behaves more like an operator console than a single payment form.

• the contacts list shows saved network payees and recent hosted request counterparties with aliases, favorite status, payment defaults, payee limits, handles, profile links, trust status, profile-change warnings, and Pay/Request/Save/Star/Defaults/Limits actions
• the checkout links list shows recent pay/request links, open counts, last-opened timestamps, and cancellation controls
• the activity inbox shows direct payments, hosted payment requests, and the next likely operator action
• receipt and status pages give human users and agents the same shared view of a payment
• hosted links can deep-link back into Conto Pay so the assistant can inspect, retry, or explain the current state

For teams running organization-to-organization payments, this makes the closed loop visible. The same hosted surfaces cover discovery, request review, authorization, execution, and post-payment receipt lookup.

​

Closed-Loop Network Payments

When the selected recipient is another hosted Conto Pay workspace on the same chain, Conto Pay can complete the transfer as a hosted closed-loop payment.

• the payee is first verified and stored as a network recipient in your allowlist
• the payment is still drafted and authorized like any other Conto Pay payment
• the same wallet policies, agent policies, approval thresholds, and approval workflows still apply
• the managed execution service records the transfer as A2A
• the payer wallet is debited and the recipient wallet is credited inside Conto’s hosted ledger
• if later chain confirmation fails, the provisional recipient credit is rolled back with the other ledger effects

This matters because network payments keep the hosted operating model intact. You do not switch to a separate protocol, a different assistant, or a weaker policy path just because the payee is also on Conto.

​

Policy And Approval Model

Conto Pay does not use a separate rule engine. The hosted workspace still relies on the normal Conto controls:

• wallet policies
• agent policies
• recipient allowlists
• approval thresholds
• approval workflows

That means sandbox and live money can share the same control model even when the funding and execution environment changes. The Conto Pay workspace exposes an activation status for both users and agents. A workspace can be setup-required, sandbox-ready, ready for live review, or live-enabled. Agents should read the public Profile API and check activation.livePaymentsEnabled before presenting a payee as eligible for live money movement. The workspace also exposes liveReviewRequest. If live funds are not enabled yet, the operator can submit a live-review request from the Activation card. Conto Pay dedupes that request into one support alert and includes the review status, customer-safe rollout policy, and sanitized publicRolloutEvidence summary in the Launch support packet. The customer-safe launch evidence can also be fetched by authenticated agents from GET /api/conto-pay/launch-evidence as { launchEvidence }. That packet includes public paymentMode, compact agentReadiness.actions, and a customer-safe liveReview.rolloutPolicy summary so agents can explain no-review-yet, controlled rollout, open rollout, or paused approvals without seeing internal allowlist configuration. When Conto support starts review, enables live mode, or returns the workspace to sandbox, the support packet also includes the latest review action, reviewer, review time, environment transition, saved launch-ops owner fields, and resulting live-payments flag. For guided cohorts, Conto support can export a prefilled alpha signoff Markdown note from the internal launch dashboard. It summarizes workspace readiness, live-review state, rollout gate eligibility, closed-loop evidence, funnel alerts, trust reports, and the remaining go/no-go fields for the launch owner. The same dashboard and signoff show public-rollout prerequisites that require human approval before Conto Pay moves beyond guided alpha, such as legal/compliance review, live rollout scope, funding ownership, support coverage, and customer-facing claims review. Conto support can record the approval evidence in launch ops so it appears in the dashboard, API exports, and signoff packet.

​

Typical Sandbox Flow

In sandbox, a common first run looks like this:

1. Open Conto Pay and ask whether the hosted wallet is ready.
2. Review the activation card to see whether setup, sandbox evidence, or Conto live review is next.
3. If needed, request Tempo testnet funds for the hosted wallet.
4. Review your hosted profile, handle, and Profile API URL.
5. Create a tracked checkout link if you need to share pay or request details before the payer opens Conto Pay.
6. Add or confirm an allowlisted recipient, or resolve another Conto Pay workspace as a network recipient.
7. Set recipient, amount, and purpose for the draft.
8. Authorize the request.
9. Inspect whether the request is approved, waiting for approval, denied, or ready to retry.
10. Approve, send, or retry from the same assistant thread.

​

Example Network Flow

If you want to pay another organization already using Conto Pay, see the step-by-step prompts in Example Network Prompts: resolve the target workspace, add it as a network recipient, set the amount and purpose, authorize, inspect, and send.

​

Next Steps