<p>Taproot is specified in <a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki" rel="nofollow noreferrer">BIP341</a> which also includes much relevant information such as motivation and rationale. My answer will essentially just rephrase some of its highlights.</p>
<p>Key path spends and script path spends are two distinct ways of spending a Taproot output. In a key path spend the sender just provides a signature that's valid for the public key in the P2TR output and the transaction being signed. In a script path spend the sender needs to provide a script, a proof that the P2TR output commits to this script (called the <em>control block</em>) and the initial stack to the script in order to satisfy it (which will generally include at least one signature).</p>
<p>You can tell if an input is a key path spend or a script path spend by how many witness items there are in its witness stack. If there is exactly one element in the witness stack<sup>1</sup> it is a key path spend, otherwise it is a script path spend. See an example transaction that has two inputs, one of which is a key path spend and the other is a script path spend:</p>
<p><a href="https://mempool.space/tx/37777defed8717c581b4c0509329550e344bdc14ac38f71fc050096887e535c8" rel="nofollow noreferrer">37777defed8717c581b4c0509329550e344bdc14ac38f71fc050096887e535c8</a></p>
<p>Key path spending should be used when possible as it's cheaper and doesn't reveal the existence of a possible script path. Only when the key path cannot be used (for example when agreement cannot be reached in a multiparty protocol) should the script path be used as a backup.</p>
<p>MuSig2 uses aggregated keys, which are indistinguishable from ordinary keys and can likewise be used in both key path and script path spending.</p>
<hr/>
<p><sup>1</sup> If there are at least two witness items and the last one starts with 0x50, it is the optional annex and it's removed before checking whether the input is a key path or script path spend.</p>

CC BY-SA 4.0
2023-06-15T15:48:37.247Z
Thank you very much! That's a great answer. That's a great example too, I can definitely tell the script path spend since it's much bigger. I don't think that's a reliable heuristic however, since a keypath spend could also stuff a bunch of data into the witness, correct?
Hunter Beast
CC BY-SA 4.0
2023-06-15T16:01:48.487Z
No, a key path spend cannot have any witness items apart from the signature and the optional annex. It's not a heuristic, it's literally how the consensus rules are defined.
Vojtěch Strnad
CC BY-SA 4.0
2023-06-14T21:12:04.797Z
2023-06-17T19:50:51.737Z
2023-06-17T19:50:51.737Z
Vojtěch Strnad
<p>In some analyses of chain activity, I sometimes see Taproot spends divided into key path and script path.</p>
<ol>
<li>Why are they called that?</li>
<li>Which BIPs should I read to learn more?</li>
<li>When I look at a P2TR tx in mempool.space, is there a way I can tell if an input is a key path or script path spend?</li>
<li>What does an ordinary P2TR payment use?</li>
<li>What does a MuSig2 payment use?</li>
</ol>

<taproot><p2tr><spending><musig>
How can I tell if a Taproot input is a key path spend or a script path spend?
Hunter Beast
# How can I tell if a Taproot input is a key path spend or a script path spend?

(Asked by: username_0 on 2023-06-12)

In some analyses of chain activity, I sometimes see Taproot spends divided into key path and script path.

1. Why are they called that?
2. Which BIPs should I read to learn more?
3. When I look at a P2TR tx in mempool.space, is there a way I can tell if an input is a key path or script path spend?
4. What does an ordinary P2TR payment use?
5. What does a MuSig2 payment use?

**Tags:** taproot, p2tr, spending, musig


---

## 1 answers

### Answer by username_1 on 2023-06-14. Score: 5 | Accepted answer

Taproot is specified in [BIP341](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki) which also includes much relevant information such as motivation and rationale. My answer will essentially just rephrase some of its highlights.

Key path spends and script path spends are two distinct ways of spending a Taproot output. In a key path spend the sender just provides a signature that's valid for the public key in the P2TR output and the transaction being signed. In a script path spend the sender needs to provide a script, a proof that the P2TR output commits to this script (called the *control block*) and the initial stack to the script in order to satisfy it (which will generally include at least one signature).

You can tell if an input is a key path spend or a script path spend by how many witness items there are in its witness stack. If there is exactly one element in the witness stack1 it is a key path spend, otherwise it is a script path spend. See an example transaction that has two inputs, one of which is a key path spend and the other is a script path spend:

[37777defed8717c581b4c0509329550e344bdc14ac38f71fc050096887e535c8](https://mempool.space/tx/37777defed8717c581b4c0509329550e344bdc14ac38f71fc050096887e535c8)

Key path spending should be used when possible as it's cheaper and doesn't reveal the existence of a possible script path. Only when the key path cannot be used (for example when agreement cannot be reached in a multiparty protocol) should the script path be used as a backup.

MuSig2 uses aggregated keys, which are indistinguishable from ordinary keys and can likewise be used in both key path and script path spending.

---

1 If there are at least two witness items and the last one starts with 0x50, it is the optional annex and it's removed before checking whether the input is a key path or script path spend.

> **Comments:**
> **username_0**: Thank you very much! That's a great answer. That's a great example too, I can definitely tell the script path spend since it's much bigger. I don't think that's a reliable heuristic however, since a keypath spend could also stuff a bunch of data into the witness, correct?  
> **username_1**: No, a key path spend cannot have any witness items apart from the signature and the optional annex. It's not a heuristic, it's literally how the consensus rules are defined.  

---

