Bitcoin Core enumeratesigners RPC for External Signers

This guide explains Bitcoin Core enumeratesigners RPC in plain English. It shows what the command does, what its result means and what it cannot prove.

Version and scope

The method first appears in retained 22.0 RPC documentation and takes no arguments. External-signer support was explicitly experimental, so automation must pin and regression-test the exact Core and signer versions.

Configuration

Core launches the executable configured by -signer. Use an absolute reviewed path, a restricted service account, a minimal environment and filesystem permissions that prevent untrusted replacement.

Result

Each signer entry contains a master-key fingerprint and a device name. Fingerprints help match wallet key origins but are short identifiers, not collision-resistant device authentication.

Failure modes

Expect missing executables, timeouts, malformed JSON, locked or disconnected devices, USB permissions, multiple matching fingerprints and a signer process that exits after partial output.

Security boundary

The helper is separate code with access to device communication. Treat its output as untrusted structured input, constrain execution and never pass secrets through command-line arguments or logs.

Operational use

Inventory before wallet creation, reconcile the fingerprint with an independently recorded custody register and require on-device address or transaction confirmation for later actions.

How specialists test it

Operators test the command on a non-production node first. They check a normal reply, an invalid request, a timeout and a restart. This shows what the response means and prevents one local result from being mistaken for a network-wide outcome.

Conclusion

enumeratesigners is a discovery call, not an authorisation signal. Operators should harden the signer helper, validate every response and reconcile the reported fingerprint with independent custody records before building a wallet workflow.