<p><code>bitcoin-cli</code> (and other software) communicates with Bitcoin Core using the so-called JSON-RPC protocol.</p>
<p>If you start Bitcoin Core as <code>bitcoind</code> (without GUI), that protocol is enabled by default (because otherwise there'd be no way to interact with it). If you start Bitcoin Core as <code>bitcoin-qt</code> (with GUI), that protocol is disabled by default (because the assumption is that the user will be using the GUI to interact with it). If you want to use both the GUI and the JSON-RPC protocol, you need to start <code>bitcoin-qt</code> with the <code>-server</code> argument.</p>
<p>In recent versions (since 2015 or so), you don't need to configure a username/password - <code>bitcoin-cli</code> can use &quot;cookie authentication&quot; instead to get access. Configuring a username/password is mostly useful if you want to have other external software talk to Bitcoin Core that doesn't support cookie authentication, or if you want to talk to Bitcoin Core over the network (cookie authentication only works on the local machine itself, from the same user).</p>
<p>If you do set a username/password, and pick an insecure one, there may be a risk. An attacker that gets access to the RPC interface can do anything - including stealing your money.</p>

CC BY-SA 4.0
2022-05-10T13:04:18.583Z
2022-05-10T13:04:18.583Z
Pieter Wuille
<p>I'm running the GUI version of Bitcoin Core. But I want to also be able to interact with bitcoin-cli in my Windows console. Apparently I need to set the <code>-server</code> flag before running bitcoin-qt, or set <code>server=1</code> in the config file. (I notice I can also tick a box in the GUI that says &quot;Enable RPC Server&quot; - I suppose that does the same thing?)</p>
<p>But I don't understand what this is actually doing behind the scenes. What does it mean that it's running as a &quot;server&quot;, as opposed to not being a server?</p>
<p>Are there any downsides to doing this, particularly on the security/privacy front?</p>
<p>Also, I'm curious as to why I'm required to have a username/password if wanting to use bitcoin-cli?</p>

<bitcoin-core><bitcoin-cli><server><bitcoin-qt-setup>
What does setting the "-server" flag do?
Spaterman
# What does setting the "-server" flag do?

(Asked by: username_0 on 2022-05-08)

I'm running the GUI version of Bitcoin Core. But I want to also be able to interact with bitcoin-cli in my Windows console. Apparently I need to set the `-server` flag before running bitcoin-qt, or set `server=1` in the config file. (I notice I can also tick a box in the GUI that says "Enable RPC Server" - I suppose that does the same thing?)

But I don't understand what this is actually doing behind the scenes. What does it mean that it's running as a "server", as opposed to not being a server?

Are there any downsides to doing this, particularly on the security/privacy front?

Also, I'm curious as to why I'm required to have a username/password if wanting to use bitcoin-cli?

**Tags:** bitcoin-core, bitcoin-cli, server, bitcoin-qt-setup


---

## 1 answers

### Answer by username_1 on 2022-05-10. Score: 2

`bitcoin-cli` (and other software) communicates with Bitcoin Core using the so-called JSON-RPC protocol.

If you start Bitcoin Core as `bitcoind` (without GUI), that protocol is enabled by default (because otherwise there'd be no way to interact with it). If you start Bitcoin Core as `bitcoin-qt` (with GUI), that protocol is disabled by default (because the assumption is that the user will be using the GUI to interact with it). If you want to use both the GUI and the JSON-RPC protocol, you need to start `bitcoin-qt` with the `-server` argument.

In recent versions (since 2015 or so), you don't need to configure a username/password - `bitcoin-cli` can use "cookie authentication" instead to get access. Configuring a username/password is mostly useful if you want to have other external software talk to Bitcoin Core that doesn't support cookie authentication, or if you want to talk to Bitcoin Core over the network (cookie authentication only works on the local machine itself, from the same user).

If you do set a username/password, and pick an insecure one, there may be a risk. An attacker that gets access to the RPC interface can do anything - including stealing your money.


---

