Bitcoin Core 0.20 rpcwhitelist guide covering per-user RPC allowlists, intersection rules, default-deny behaviour, authentication, testing and recovery.
This guide explains Bitcoin Core rpcwhitelist in plain English. It shows what the command does, what its result means and what it cannot prove.
Bitcoin Core rpcwhitelist: Each rpcwhitelist value binds one username to an explicit comma-separated method list. Generate configuration from reviewed structured policy rather than accepting free-form administrator text.
A node operator is checking Bitcoin Core rpcwhitelist. When several whitelist entries name the same user, Core intersects the method sets. Treat this as deliberate tightening and test the final effective set.
Keep RPC transport on a protected interface with strong generated credentials. A correct username and password identifies a caller; the whitelist then limits which command names that identity may invoke.
Each rpcwhitelist value binds one username to an explicit comma-separated method list. Generate configuration from reviewed structured policy rather than accepting free-form administrator text.
When several whitelist entries name the same user, Core intersects the method sets. Treat this as deliberate tightening and test the final effective set; duplicate fragments do not add permissions.
Unless rpcwhitelistdefault is zero, setting any whitelist causes unspecified users to receive empty whitelists. Setting the default to one with no entries also denies every RPC method.
Allowing a method does not constrain its arguments, wallet endpoint or filesystem path. Use separate users and nodes where parameter-level or tenant isolation is required.
Keep one tested emergency administrative route on a protected host, validate syntax before restart and prevent credentials or method inventories entering public logs.
Operators test the command on a non-production node first. They check a normal reply, an invalid request, a timeout and a restart. This shows what the response means and prevents one local result from being mistaken for a network-wide outcome.
Bitcoin Core rpcwhitelist: Each rpcwhitelist value binds one username to an explicit comma-separated method list.
Keep RPC transport on a protected interface with strong generated credentials. A correct username and password identifies a caller.
Each rpcwhitelist value binds one username to an explicit comma-separated method list.
When several whitelist entries name the same user, Core intersects the method sets.
Bitcoin Core RPC whitelists add useful method-level least privilege, but they do not replace network isolation or careful command design. Build explicit roles, test denial paths and preserve a protected recovery route.
Check the current specification status and the documentation for the exact implementation you operate before moving production funds or changing a mining node.
Bitcoin Core 30 data-carrier policy explained: larger OP_RETURN defaults, multiple outputs, aggregate sizing and the boundary between policy and consensus.
Bitcoin Core AssumeUTXO guide covering height 840000 mainnet snapshots, authenticated loading, dual chainstates, background validation, storage and rollback.
Learn how Bitcoin Testnet4 mining works, what it can earn, the costs and security checks, and how a Bitcoin node can support SHA-256 miners.
Join the ASIC Mining Discussion
Members can read and join the discussion
Log in to read comments from other miners. Create a free account if you would like to ask a question or share your experience.
Membership helps us protect the discussion from spam and keep answers useful.