Bitcoin Core combinerawtransaction RPC: Signature Merge Guide

This guide explains Bitcoin Core combinerawtransaction RPC in plain English. It shows what the command does, what its result means and what it cannot prove.

Input array contract

The sole argument is a JSON array of raw transaction hex strings, not txids despite imprecise wording in the historical help. Validate hex, maximum size and array count before RPC. Preserve the order and hash of every supplied artefact so a failed or unexpected merge can be audited without exposing private keys or unrelated wallet data.

Identical transaction requirement

Partial versions must share version, inputs and outpoints, input sequences, outputs, amounts, scripts and locktime; only signature material should differ. Decode and compare the unsigned transaction before combining. If any recipient, amount, fee-relevant input or locktime differs, stop rather than letting one variant become the accidental signing target.

Signature merge only

The RPC collects compatible signatures and scripts; it does not derive keys or approve the payment. A malicious or mistaken signer can supply a transaction for another intent. Each signer should verify human-readable destinations, amounts, fee, change and network on trusted software before contributing a signature.

Possibly partial result

Returned hex may still lack the required signatures. Run the appropriate historical script verification or signing-completeness check and inspect every input. Do not infer completeness from a changed byte length or a successful RPC response. Store a clear state such as unsigned, partially signed, complete, rejected or broadcast.

Multisigner exchange

Move partial transactions through authenticated channels with transaction fingerprints and signer identity references. Avoid copying them through public tickets or chat even though signatures are not private keys; the data reveals payment graph and operational timing. Reject duplicate, stale or unauthorised contributions and expire the signing session after broadcast.

Broadcast boundary

Combining is not broadcasting. Before sendrawtransaction, perform a separate approval that verifies the final transaction id, outputs, fee and completeness against the original request. Broadcasting is an external state change with financial consequences and should use distinct credentials from a stateless combination service.

How specialists test it

Operators test the command on a non-production node first. They check a normal reply, an invalid request, a timeout and a restart. This shows what the response means and prevents one local result from being mistaken for a network-wide outcome.

Conclusion

combinerawtransaction is a deterministic signature-merging step, not an approval or broadcast service. Safety comes from proving all variants describe one transaction, checking the final scripts and preserving a separate financial authorisation boundary.