Bitcoin Core RPC

Bitcoin Core RPC is a JSON-RPC 2.0 interface that listens on a TCP port (default 8332 for mainnet, 18332 for testnet) and requires authentication via username/password or cookie file. It enables applications to send commands like getblockchaininfo, getblock, and sendtoaddress to a node, which then executes them against its local copy of the blockchain. The interface is defined in the rpc/ directory of the Bitcoin Core source code, with each command documented in the help output. RPC calls are synchronous and can be batched, but they are not designed for high-frequency streaming; for that, developers often use the ZeroMQ (ZMQ) notification interface. The RPC server is disabled by default and must be explicitly enabled with the -server flag or by setting server=1 in the configuration file.

RPC is used by a wide range of Bitcoin applications, from simple wallet management to complex analytics. Wallet commands such as getnewaddress, listunspent, and sendrawtransaction allow programs to create and broadcast transactions. Blockchain queries like getblockhash and getrawtransaction provide raw data for explorers and research tools. Network commands like getpeerinfo and getnetworkinfo help monitor node health. Many popular libraries, including bitcoin-cli (the command-line client), python-bitcoinlib, and bitcoinjs-lib, wrap these RPC calls. Exchanges and payment processors rely on RPC to manage hot wallets and track deposits. However, RPC is not intended for public exposure; it should be firewalled and accessed only over trusted networks, as it grants full control over the node and its wallets.

Security is critical because RPC commands can move funds and alter node behavior. Authentication is handled via HTTP Basic Auth, with credentials stored in the configuration file or generated as a random cookie file (typically .cookie) that is recreated on each node start. The -rpcuser and -rpcpassword options are deprecated in favor of the cookie method. For additional protection, Bitcoin Core supports -rpcwhitelist to restrict which commands a client can execute, and -rpcbind to limit the listening interface. Since RPC is unencrypted by default, it should never be exposed to the internet; instead, use SSH tunneling or a VPN. In version 0.12.0, the disablewallet option was added to run a node without wallet functionality, reducing attack surface. The rest interface (HTTP GET) offers read-only access to some data, but it is not a substitute for RPC.

Beyond the common commands, Bitcoin Core RPC includes several niche features. The getmempoolinfo and getrawmempool commands expose the memory pool, which is useful for fee estimation and transaction propagation analysis. The gettxoutsetinfo command provides statistics about the UTXO set, which is essential for research on chain state. The getblockchaininfo includes a pruned flag, indicating whether the node is running in pruned mode, which affects which historical blocks are available. The getnetworkhashps command estimates network hash rate, and getdifficulty returns the current difficulty. A little-known feature is the getzmqnotifications command, which lists active ZMQ subscriptions. Additionally, the getdescriptorinfo command helps analyze output descriptors, a newer standard for describing scripts. The RPC interface also supports batch requests, allowing multiple commands in a single HTTP request, which can improve performance for bulk operations.

JSON-RPC

A remote procedure call protocol encoded in JSON, used for communication between clients and servers.

UTXO

Unspent Transaction Output; the set of outputs that have not been spent, representing available coins.

Mempool

A node's collection of unconfirmed transactions waiting to be included in a block.

ZeroMQ (ZMQ)

A messaging library used by Bitcoin Core to publish notifications about new blocks and transactions.

Output descriptor

A string that describes a scriptPubKey pattern, used for wallet and address management.