Xaman
Xaman SignIn is SEPARATE from suite SSO.
| Suite SSO | Xaman SignIn | |
|---|---|---|
| Home | https://wallet.riddlewallet.com | Xaman app + Platform API on the consuming app origin |
| Cookie | rdl_sess Domain=.riddlewallet.com | Xaman payload UUID / app-local token |
| Message | riddle-wallet:connected | Xaman websocket / REST poll |
| Seed | Riddle on-device keystore | Keys in Xaman — never imported into Riddle |
When to use which
- Suite apps (Swap, Bridge, Cafe, Hub, games, Dev) should connect Riddle Wallet first: SSO.
- Xaman remains valid for XRPL users who sign payloads (Payment, OfferCreate, SignIn) without using the Riddle keystore.
- Cafe broker offers, some Bridge deposits, and legacy XRPL flows still create Xaman payloads on the app origin.
SignIn flow (Xaman only)
- App origin creates a SignIn payload (Platform API; keys stay server-side).
- User scans / opens Xaman.
- App polls until signed or expired.
- Store that session under an app-local key — never write it to
rdl_sess.
Do not
- Mix Xaman session keys with
rdl_sess - Ask a user who already has Riddle SSO to import a seed into Xaman (or vice versa) as a requirement
- Put Xumm API secrets in the browser
Suite connect details: SSO. Payload warnings still apply to Xaman-signed txs: payloads.