Bitcoin Core addmultisigaddress RPC: 0.16 Wallet Guide

This guide explains Bitcoin Core addmultisigaddress RPC in plain English. It shows what the command does, what its result means and what it cannot prove.

Threshold and key list

nrequired is the number of valid signatures needed from the supplied keys. Validate that the threshold is positive and does not exceed the number of distinct keys, reject duplicates and preserve key order because it affects the redeem script and address. A two-of-three label is not enough evidence; decode the returned script independently.

Key material boundary

The historical call accepted hex public keys or Bitcoin addresses whose public keys were known to the wallet. It was intended for non-watch-only usage, while importaddress served watch-only P2SH monitoring. Never transmit private keys to this RPC. Confirm which signer owns each public key and whether every required key can be recovered without the node.

Address-type choice

The optional 0.16 address_type values were legacy, p2sh-segwit and bech32, defaulting from addresstype. Each produces a different output and compatibility boundary. Some counterparties did not accept native Bech32 at the time. Decode the address into its script, confirm network and type, and test send, recognition and spending with every downstream service.

Redeem script and result change

The new result object contained address and redeemScript. A deprecated compatibility mode could return only the address, and clients were told to migrate before 0.17. Parse by explicit version and expected type rather than accepting either shape silently. Store the redeem or witness script in a protected recovery record linked to its exact ordered keys and threshold.

Backup and recovery

Adding the address changed wallet metadata and required a new backup. A wallet backup alone does not prove the external signers are recoverable, while signer seeds alone may omit key order, script type and derivation paths. Rebuild the script on an offline machine, restore wallet monitoring and produce a valid threshold spend before accepting deposits.

Access and approval

The RPC changes wallet state and creates a destination customers may fund. Restrict wallet RPC credentials, require a reviewed signer manifest and display the decoded script to two reviewers. Record public keys and derivation references, but keep seeds, private extended keys and authentication credentials outside application logs and article evidence.

How specialists test it

Operators test the command on a non-production node first. They check a normal reply, an invalid request, a timeout and a restart. This shows what the response means and prevents one local result from being mistaken for a network-wide outcome.

Conclusion

addmultisigaddress can register a multisignature destination, but the returned address is only the beginning of the security job. Operators must verify the script, preserve signer context, create a fresh backup and prove independent recovery before funds arrive.