Wallet Setup

caput's bot never holds your private keys. Every signing event uses your wallet. This document walks through each supported wallet and what signing looks like in each.

Two tiers

Tier A — Native integration. The bot talks directly to the wallet via SDK or browser extension API. You see a push notification or popup, you click sign, the signed transaction returns to the bot automatically.

Tier B — Manual paste. The bot outputs a transaction payload as JSON (with QR code). You sign it in any wallet of your choice, then paste the signed result back into the bot. Slower but works with any XRPL wallet.

You can change your adapter in the bot's admin UI at any time.

Tier A · Xaman (mobile)

Xaman is the mobile wallet formerly known as XUMM. It works via push notifications.

One-time setup

1. Install Xaman from the App Store (iOS) or Google Play (Android).
2. Create or import your XRPL account in Xaman.
3. In the caput bot's admin UI, choose "Connect via Xaman."
4. Scan the QR code with the Xaman app.
5. Approve the connection in Xaman.

Your bot is now linked to your Xaman wallet for signing requests.

Signing flow

When the bot needs you to sign:

1. Bot constructs the transaction.
2. Pushes a sign request to Xaman via the SDK.
3. Your phone receives a notification.
4. Open Xaman, review the transaction details.
5. Slide to sign.
6. The signed transaction returns to the bot automatically.

If you don't sign within a timeout (default 5 minutes), the request expires and the bot surfaces an error.

What to verify before signing

Always check in Xaman before approving:

• The transaction type matches what you expect (Payment, SignerListSet, etc.)
• The destination address matches the bot's stated counterparty
• The amount is what you intended
• For multisig setup: the signer list contains the expected addresses

Tier A · Crossmark (desktop browser)

Crossmark is a browser extension wallet for XRPL. It works on Chrome, Firefox, Brave, and Edge.

One-time setup

1. Install Crossmark from the Chrome Web Store or your browser's extension marketplace.
2. Create or import your XRPL account in Crossmark.
3. In the caput bot's admin UI (running in your browser), choose "Connect via Crossmark."
4. A popup appears requesting connection — approve it.

The browser tab is now linked to your Crossmark wallet.

Signing flow

When the bot needs you to sign:

1. Bot constructs the transaction in the browser-side UI.
2. Calls Crossmark's signAndSubmit API.
3. Crossmark popup appears with transaction details.
4. Review and click sign.
5. Crossmark signs and submits to the XRPL.
6. Result returns to the bot.

This is the fastest signing flow if you operate on desktop.

What to verify before signing

Crossmark's popup shows the full transaction. Check:

• Transaction type
• Destination
• Amount and currency
• Any flags or special fields

If anything looks wrong, click reject. Nothing is signed until you explicitly approve.

Tier A · Gem Wallet (desktop browser)

Gem Wallet is a browser extension wallet, similar in shape to Crossmark.

One-time setup

1. Install Gem Wallet from the Chrome Web Store.
2. Create or import your XRPL account.
3. In the caput bot's admin UI, choose "Connect via Gem Wallet."
4. Approve the connection in the popup.

Signing flow

Same shape as Crossmark:

1. Bot constructs transaction
2. Gem Wallet popup with details
3. Review, sign
4. Returns to bot

Tier B · Manual paste

Universal fallback. Works with any XRPL wallet — Bithomp Tools, XRPL.org test wallets, hardware wallets via Bithomp Desktop, command-line tools, anything that can sign an XRPL transaction.

Signing flow

1. Bot constructs the transaction and outputs it as JSON.
2. Bot displays the JSON in the admin UI, with a QR code for mobile transfer.
3. You copy the JSON (or scan the QR) into your wallet of choice.
4. Your wallet displays the transaction. You review and sign.
5. Wallet outputs the signed transaction blob.
6. You paste the signed blob back into the bot's admin UI.
7. Bot validates the signature and submits.

This is slower than Tier A — three to four extra clicks per signing event — but it works with any wallet that can sign XRPL transactions.

When to use manual paste

• You use a wallet not covered by Tier A.
• You want to use a hardware wallet (Ledger, Trezor) via a separate signing tool.
• You operate in an air-gapped or high-security environment.
• You are debugging and want to see the exact transaction before signing.

What to verify before signing

Manual paste gives you the most visibility — you see the full JSON. Verify:

• TransactionType
• Account (your address)
• Destination (where it's going)
• Amount (exact value, in drops for XRP or in RLUSD)
• Fee (transaction fee in drops)
• SigningPubKey (matches your wallet)
• Memos (if relevant)

If any field is wrong, do not sign.

Hardware wallets

Caput does not natively integrate with hardware wallets (Ledger, Trezor). Use them through:

• Crossmark with Ledger. Crossmark supports Ledger via USB. Your Ledger is the signing key; Crossmark is the bridge.
• Manual paste with hardware wallet desktop tools. Sign in Bithomp Desktop or similar, paste the signed blob into caput.

Native HID-level Ledger integration is not planned for the initial release.

Security notes

• Never paste your seed phrase or secret key into the bot. The bot never asks for it. If anyone asks for your seed, it is a phishing attempt.
• Verify the signing payload matches what you expect. Especially for high-value transactions or first-time setups.
• Use a hot wallet you can afford to lose for testing. Move to a hardware-wallet-backed account for real contracts.
• Keep your wallet software updated. Wallet vulnerabilities are real and patched regularly.

Switching adapters

You can change your wallet adapter in the bot's admin UI under Settings → Wallet Adapter. The change applies to future signing events; in-flight signing requests continue with whichever adapter started them.

If you switch from Xaman to Manual Paste because you lose your phone, your bot can keep operating — you just sign manually instead of via push.

Troubleshooting

Push notification never arrives (Xaman). Check Xaman's Notification settings; the app needs notification permissions and a working internet connection. If still failing, switch temporarily to Manual Paste.

Crossmark popup doesn't appear. Make sure the extension is enabled and the bot's admin UI is on a domain Crossmark recognizes. Try refreshing.

Manual paste says "invalid signature." Most often a copy-paste error — make sure you copied the entire blob without truncation or extra whitespace. Try again.

Wallet says "insufficient balance." XRPL requires a small reserve (currently 10 XRP) plus enough for the transaction fee. Your spendable balance must cover the transaction amount plus fees.