Bitcoin Core createmultisig RPC: Stateless Script Guide

This guide explains Bitcoin Core createmultisig RPC in plain English. It shows what the command does, what its result means and what it cannot prove.

Threshold contract

nrequired specifies how many signatures are needed from the ordered key list. Validate it against the number of unique compressed public keys and operational policy. A one-of-many script offers different theft and availability properties from a two-of-three script. The threshold must match the written custody design, not simply an RPC example.

Public keys, not secrets

Supply hex-encoded public keys only. Never send private keys, seeds or private extended keys to the node or a construction service. Validate curve points and network-independent derivation records, then identify which independent signer controls each key without exposing its secret. Duplicate keys can undermine the intended separation of custody.

Ordering and script identity

Key order affects the redeem script and derived address. Preserve the exact ordered list and decode the returned script with an independent implementation. If using BIP 67 sorted keys as an application convention, sort deliberately and document it; createmultisig does not make every input ordering interchangeable.

Stateless versus wallet registration

createmultisig returns address and redeemScript but does not make a wallet watch or spend the output. Addmultisigaddress registers wallet metadata and, in 0.16, introduced address-type control. For offline construction, import the exact script into monitoring infrastructure under a tested watch-only procedure before any deposit.

Historical deprecation boundary

The 0.16 help deprecated using addresses as inputs and required a compatibility option for that path, while documenting public keys as the supported list. Do not model modern descriptor output or later address-type parameters as if they existed in this historical call. Version-pin clients and parse the expected object shape.

Recovery package

Retain threshold, ordered public keys, redeem script, address, network, derivation references and signer-recovery instructions. Keep this public recovery metadata separate from signer secrets. At least two reviewers should reconstruct the address independently and prove the required signer combination can authorise a spend after a total node and wallet loss.

How specialists test it

Operators test the command on a non-production node first. They check a normal reply, an invalid request, a timeout and a restart. This shows what the response means and prevents one local result from being mistaken for a network-wide outcome.

Conclusion

createmultisig builds a script but does not build a custody system. Operators must verify threshold and key order, arrange monitoring, preserve public recovery data and prove independent signer restoration before accepting funds.