ID MANDAT and the XRP Ledger

As of 25 October 2026

ID MANDAT confirms which company stands behind a domain and what its AI agents may do. The XRP Ledger (XRPL) stores accounts and payments. The two can be linked in both directions, without writing anything new to the ledger. Whoever controls the domain shows that they also control the account.

What is proven

The domain names the account

The file /.well-known/idmandat.json on your domain contains the address of your XRPL account. Only someone who controls the domain can change it.

The account names the domain

The XRPL account has your domain in its Domain field. Only someone with the account’s key can change it.

If both sides point at each other, it is proven that whoever controls this domain also controls this account. ID MANDAT reads the field straight from the ledger, when you register and in the nightly re-check. The seal then shows the WALLET segment, and the signed API response contains xrplProof.

Four steps

Add the address to your idmandat.json

Add to your file:

"xrplProof": { "address": "rYOURADDRESS…" }

Set the domain in the account

Enter exactly your domain in the account’s Domain field: lowercase, without https:// and without www., for example idmandat.com. You can do this with the account settings of an XRPL explorer such as Bithomp (sign in with your wallet and confirm there). The Xaman app alone does not offer the field. Never enter your secret recovery phrase anywhere.

Optional: xrp-ledger.toml

Many explorers also read /.well-known/xrp-ledger.toml on your domain. At minimum:

[[ACCOUNTS]]
address = "rYOURADDRESS…"
network = "main"

You can test it with Bithomp’s TOML checker, for example.

Have it checked

When you register and in the nightly re-check, ID MANDAT re-reads the file and the account. The “XRP account (ledger)” row then appears on your domain’s check page. The proof is renewed on every re-check; if one side no longer matches, it lapses.

What the proof does not say

Nothing about the balance, creditworthiness or quality of the account.
Nothing about whether the operator acts honestly. ID MANDAT confirms identity and authority, not trustworthiness.
A domain field alone proves nothing, because anyone can enter any domain there. Only the reverse direction (the domain names the account) turns it into proof.
The “Verified” level (imprint and register) is independent of this. The account proof is an extra.

Where you see it

In the seal as the WALLET segment (it also appears for a proven EVM wallet).
On the check page in the “XRP account (ledger)” row with the address.
In the signed lookup API response as the field xrplProof, see the API reference.

Check before you pay

A proven account also protects others: whoever wants to pay your domain can first check that the address really belongs to you, on the page Check a payment address (for people and agents, also for Ethereum, BNB and Solana).

Example: idmandat.com

We did it ourselves. The address is in our idmandat.json and in the xrp-ledger.toml. The matching check page: check of idmandat.com.

For wallets on Ethereum-compatible networks (EVM) the same proof works by signature, described on the page How an agent checks the seal.