Suite SSO

Suite SSO is Riddle Wallet identity. It is not Xaman SignIn.

Connect URL

Open Wallet with query params (order does not matter):

https://wallet.riddlewallet.com?return=&app=&action=connect

Param	Required	Notes
`action`	yes	`connect` (also `sign` / `pay` for payloads)
`app`	yes	Suite id: `hub`, `swap`, `bridge`, `cafe`, …
`return`	yes	Full URL on `riddlewallet.com` or `*.riddlewallet.com` (localhost allowed in dev)
`source`	optional	Hub chrome sends `source=suite`
`chain`	optional	Hint (`xrpl`, `evm`, `solana`, `stellar`)

Example — hub connect:

https://wallet.riddlewallet.com?app=hub&action=connect&return=https%3A%2F%2Friddlewallet.com%2F

Cookie

Name	Domain	Role
`rdl_sess`	`.riddlewallet.com`	Suite identity session (address + SSO). Shared across apps.

Do not treat rdl_sess as a signing unlock. Signing is gated by local PIN / swipe and idle re-auth.

Identity TTL is separate from re-auth. Re-auth idle default is 1 hour (REAUTH_IDLE_MS = 3600000). After idle, the address session can still be present; the user must unlock again before send / swap / bridge.

postMessage

Wallet may notify the opener:

{
  "type": "riddle-wallet:connected",
  "address": "r…",
  "chain": "xrpl",
  "source": "riddle-wallet"
}

Listen only for event.origin equal to the Wallet origin (https://wallet.riddlewallet.com). Store riddle_wallet_session in localStorage on the app origin.

Related types (do not mix with Xaman): riddle-wallet:disconnected, riddle-wallet:ready, riddle-wallet:signed, riddle-wallet:session-changed.

Rules

No second seed import on Swap, Bridge, Cafe, Dev, games, or Hub.
return= is allow-listed. Reject open redirects.
Never put seeds, PINs, or private keys in query strings, cookies, or postMessage.
Xaman SignIn is a separate identity system. Do not copy Xaman tokens into rdl_sess.

Full walkthrough: Getting started · Xaman · Deep links.