<p>The http remote procedure call (RPC) interface enforces <a href="https://en.wikipedia.org/wiki/Basic_access_authentication" rel="nofollow noreferrer">"basic access authentication"</a>. "Cookie-based" authentication is misleading because it doesn't actually use <a href="https://en.wikipedia.org/wiki/HTTP_cookie" rel="nofollow noreferrer">http cookies</a>. The short story is that on startup if you don't otherwise specify credentials via <code>rpcuser</code>+<code>rpcpassword</code>, bitcoind will write a file named ".cookie" in the data directory with contents "__cookie__:abc123" where __cookie__ is the basic auth username and abc123 is a randomly generated password. On shutdown, bitcoind deletes the file.</p>

CC BY-SA 4.0
2018-11-22T11:12:02.513Z
"cookie" here isn't a reference to HTTP cookies, but to an authentication cookie, like for example X11 uses for authentication. I believe that use of the term cookie actually predates HTTP itself.
Pieter Wuille
CC BY-SA 4.0
2018-11-22T14:00:39.193Z
@PieterWuille I believe that use of the term cookie actually predates computers themselves :p Whatever it may mean elsewhere, in the context of an http interface, "cookie" is most naturally interpreted as "http cookie". If you don't believe me, give a dozen developers an http URL, a file named ".cookie", and the statement "its contents are used as authentication token", and see how many try to put the contents into a "Cookie" header. See also https://bitcoin.stackexchange.com/questions/43769/using-php-with-rpc-and-cookie
Chris Arnesen
CC BY-SA 4.0
2018-11-22T17:33:17.593Z
I meant the term cookie specifically in the meaning of "a file in the local filesystem a client can read to obtain an authentication token for a server running on the same system". It may be confusing to people who aren't familiar with the concept, but it certainly isn't a misnomer - it's the established name for that concept.
Pieter Wuille
CC BY-SA 4.0
2018-11-13T05:17:57.047Z
2018-11-22T23:42:46.080Z
2018-11-22T23:42:46.080Z
Chris Arnesen
<p>In the recent version of Bitcoin Core, the name of script is <code>rpcauth.py</code> and its located in <code>./bitcoin/share/rpcauth/rpcauth.py</code> (available on <a href="http://github.com/bitcoin/bitcoin" rel="nofollow noreferrer">Bitcoin Core's github repository</a> as well, <a href="https://github.com/bitcoin/bitcoin/blob/master/share/rpcauth/rpcauth.py" rel="nofollow noreferrer">share/rpcauth/rpcauth.py</a>).</p>

CC BY-SA 3.0
2018-01-28T17:30:18.697Z
2018-03-03T23:16:18.727Z
2018-03-03T23:16:18.727Z
Lisbeth
<p>I was struggling with this same difficulty and managed to make it work. Obviously, bitcoin-cli must be made aware of credentials to use when making RPC calls, and I am guessing here that bitcoin-cli expects the credentials specified with variablies rpcuser and rpcpassword. However, these two variables are unnecessary to allow one to authenticate when making an RPC call via HTTP. So for bitcoin-cli's sake, bitcoind generates the .cookie file when rpcuser and rpcpassword are not defined in bitcoin.conf</p>

<p>Another thing I wanted to point out is that one can actually have a password of their choosing when using ./share/rpcauth/rpcauth.py to generate credentials. Simply pass to it two parameters as such <code>./share/rpcauth/rpcauth.py &lt;username&gt; &lt;password&gt;</code> and you'll have it.</p>

CC BY-SA 4.0
2019-07-28T11:40:26.103Z
At the end of your first paragraph, I believe you meant to write `bitcoin.conf` instead of `bitcoin.info`.
thalisk
CC BY-SA 4.0
2019-07-30T08:53:00.513Z
Yes, most probably. Thanks for pointing that out.
bibiki
CC BY-SA 4.0
2019-03-09T23:11:22.553Z
2019-07-30T08:54:10.693Z
2019-07-30T08:54:10.693Z
bibiki
<p>I did not happen to have a full implementation of bitcoin, but found the rpcauth.py script in the &quot;share&quot; directory under a litecoin build that I have. I seems to be coin agnostic and worked great!</p>

CC BY-SA 4.0
2021-01-05T02:39:15.413Z
2021-01-05T02:39:15.413Z
John Rigler
<p>i solved this for my Node by following lines in the Bitcoin.cfg after i started the client ( not the QT) with </p>

<p>-rpcuser=mynamewhateveryounameit</p>

<p>and in the Config i wrote</p>

<p><em>Position of the Cookie = your Password)</em>
rpccookiefile=D:\Bitcoin\wallet.cookie </p>

<p><em>allow not needed i guess for you are allways free to connect in your network but i did it anyway</em>
rpcallowip=127.0.0.1</p>

<p><em>connection to the python proxy ( i use python-bitcoinrpc-master, much better then Python only</em></p>

<p>from bitcoinrpc.authproxy import AuthServiceProxy</p>

<p>And thats all for the reason that it soon will be impossible to set your password or Username in the Config file.
dont know why, but it is like it is</p>

CC BY-SA 4.0
2019-05-07T02:37:05.827Z
2019-05-07T02:37:05.827Z
TrashPoet
<p>This happened to me when my datadir was not in the default location of <code>/Users/nameHere/Library/Application Support/Bitcoin/bitcoin.conf</code>. bitcoin-cli needed an explicit command to locate it.</p>
<pre><code>./src/bitcoin-cli -rpccookiefile=&quot;/Volumes/Bitcoin Core/.cookie&quot; getblockchaininfo
</code></pre>
<p>Not ideal, would prefer is I could set this as an environment variable and have the cli pick it up from there. Have to check if that is possible.</p>

CC BY-SA 4.0
2022-11-19T21:39:02.050Z
Do you have a Bitcoin Core Volume? Is that common as an Apple idiom, or is a way of yours?
Mercedes
CC BY-SA 4.0
2022-11-19T21:33:49.767Z
2022-11-19T21:33:49.767Z
dorrian_s_finney
<p>Cookie based authentication is used when no rpc password is provided. The 0.12 release of Bitcoin Core had the following to say about it:</p>

<blockquote>
  <p>When no -rpcpassword is specified, the daemon now uses a special
  ‘cookie’ file for authentication. This file is generated with random
  content when the daemon starts, and deleted when it exits. Its
  contents are used as authentication token. Read access to this file
  controls who can access through RPC. By default it is stored in the
  data directory but its location can be overridden with the option
  -rpccookiefile.</p>
  
  <p>This is similar to Tor’s CookieAuthentication: see
  <a href="https://www.torproject.org/docs/tor-manual.html.en" rel="noreferrer">https://www.torproject.org/docs/tor-manual.html.en</a></p>
  
  <p>This allows running bitcoind without having to do any manual
  configuration.</p>
</blockquote>

<p>If all you use is <code>bitcoin-cli</code> without need for the RPC user/password stuff, you should probably just comment out or remove <code>rpcuser=XXX</code> and <code>rpcpassword=YYY</code> from <code>bitcoin.conf</code> and restart bitcoin. It "should just work [tm]".</p>

<p>If you need a specified rpc user/pass combo, you need to switch to using <code>rpcauth</code> instead of <code>rpcuser</code>/<code>rpcpassword</code>. </p>

<p>The <code>rpcauth</code> is described as</p>

<blockquote>
  <p>Username and hashed password for JSON-RPC connections. The field  comes in the format: <code>&lt;USERNAME&gt;:&lt;SALT&gt;$&lt;HASH&gt;</code>. A canonical python script is included in share/rpcuser. This option can be specified multiple times</p>
</blockquote>

<p>In <code>share/rpcuser</code> (<a href="https://github.com/bitcoin/bitcoin/blob/master/share/rpcauth/rpcauth.py" rel="noreferrer">on github</a>) there is a Python script which lets you create such a user/password combo (note that you are <strong>given</strong> the password, you do not get to specify it yourself). </p>

<p>Grab that python script, then run it. E.g.</p>

<pre><code>$ python ./rpcuser.py foo
String to be appended to bitcoin.conf:
rpcauth=foo:a14191e6892facf70686a397b126423$ddd6f7480817bd6f8083a2e07e24b93c4d74e667f3a001df26c5dd0ef5eafd0d
Your password:
VX3z87LBVc_X7NBLABLABLABLA
</code></pre>

<p>Then replace <code>rpcuser</code> with <code>foo</code> and <code>rpcpassword</code> with <code>VX3z87LBVc_X7NBLABLABLABLA</code> wherever you are connecting to the bitcoind RPC.</p>

CC BY-SA 3.0
2018-01-13T20:22:07.173Z
I tried to do this, but when I removed rpcuser and rpcpassword from bitcoin.conf I started to get this message:  No rpcpassword set - using random cookie authentication Generated RPC authentication cookie. I added rpcauth generated by rpcuser.py but it doesn't seem to recognize it. What am I missing?
hsmiths
CC BY-SA 3.0
2018-01-15T02:19:31.140Z
@hsmiths You can use the randomly generated cookie file in the bitcoin data directory, or you can add an rpcauth line to bitcoin.conf. Not sure why the rpcauth line isn't recognized. I've used it in the past.
Kalle
CC BY-SA 3.0
2018-01-29T10:54:43.437Z
@hsmiths Yor message 'No PRC password set...' is actually a message that says cookie auth is working.
Willtech
CC BY-SA 4.0
2018-11-15T04:10:42.217Z
This doesn't actually describe how to use "cookie-based" authentication. Instead it describes how to use "rpcauth", which was not the question. This should not be the "accepted" answer.
Chris Arnesen
CC BY-SA 4.0
2019-07-28T11:27:25.880Z
For the record, the script `rpcauth.py` only works with python3.
thalisk
CC BY-SA 4.0
2019-07-28T11:33:33.053Z
Also you can give the password to `rpcauth.py` yourself by running it as `python3 /path/to/rpcauth.py myusername -`. The final `-` means the script will prompt you for the password. Works with bitcoin-core v0.18.
thalisk
CC BY-SA 3.0
2016-09-12T04:14:57.270Z
2018-01-09T14:13:22.143Z
2018-01-09T14:13:22.143Z
Kalle
<p>I am getting a message when I start bitcoind :</p>

<p><code>Config options rpcuser and rpcpassword will soon be deprecated. Locally-run instances may remove rpcuser to use cookie-based auth, or may be replaced with rpcauth. Please see share/rpcuser for rpcauth auth generation</code></p>

<p>What is cookie based auth and how can I use it ?</p>

<p>Thanks</p>

<bitcoind>
rpc cookie authentication
sektor
# rpc cookie authentication

(Asked by: username_0 on 2016-07-29)

I am getting a message when I start bitcoind :

`Config options rpcuser and rpcpassword will soon be deprecated. Locally-run instances may remove rpcuser to use cookie-based auth, or may be replaced with rpcauth. Please see share/rpcuser for rpcauth auth generation`

What is cookie based auth and how can I use it ?

Thanks

**Tags:** bitcoind


---

## 7 answers

### Answer by username_10 on 2016-09-12. Score: 29 | Accepted answer

Cookie based authentication is used when no rpc password is provided. The 0.12 release of Bitcoin Core had the following to say about it:

> When no -rpcpassword is specified, the daemon now uses a special
> ‘cookie’ file for authentication. This file is generated with random
> content when the daemon starts, and deleted when it exits. Its
> contents are used as authentication token. Read access to this file
> controls who can access through RPC. By default it is stored in the
> data directory but its location can be overridden with the option
> -rpccookiefile.
>
> This is similar to Tor’s CookieAuthentication: see
> <https://www.torproject.org/docs/tor-manual.html.en>
>
> This allows running bitcoind without having to do any manual
> configuration.

If all you use is `bitcoin-cli` without need for the RPC user/password stuff, you should probably just comment out or remove `rpcuser=XXX` and `rpcpassword=YYY` from `bitcoin.conf` and restart bitcoin. It "should just work [tm]".

If you need a specified rpc user/pass combo, you need to switch to using `rpcauth` instead of `rpcuser`/`rpcpassword`.

The `rpcauth` is described as

> Username and hashed password for JSON-RPC connections. The field comes in the format: `<USERNAME>:<SALT>$<HASH>`. A canonical python script is included in share/rpcuser. This option can be specified multiple times

In `share/rpcuser` ([on github](https://github.com/bitcoin/bitcoin/blob/master/share/rpcauth/rpcauth.py)) there is a Python script which lets you create such a user/password combo (note that you are **given** the password, you do not get to specify it yourself).

Grab that python script, then run it. E.g.

```
$ python ./rpcuser.py foo
String to be appended to bitcoin.conf:
rpcauth=foo:a14191e6892facf70686a397b126423$ddd6f7480817bd6f8083a2e07e24b93c4d74e667f3a001df26c5dd0ef5eafd0d
Your password:
VX3z87LBVc_X7NBLABLABLABLA

```

Then replace `rpcuser` with `foo` and `rpcpassword` with `VX3z87LBVc_X7NBLABLABLABLA` wherever you are connecting to the bitcoind RPC.

> **Comments:**
> **username_11**: I tried to do this, but when I removed rpcuser and rpcpassword from bitcoin.conf I started to get this message:  No rpcpassword set - using random cookie authentication Generated RPC authentication cookie. I added rpcauth generated by rpcuser.py but it doesn't seem to recognize it. What am I missing?  
> **username_10**: @username_11 You can use the randomly generated cookie file in the bitcoin data directory, or you can add an rpcauth line to bitcoin.conf. Not sure why the rpcauth line isn't recognized. I've used it in the past.  
> **username_12**: @username_11 Yor message 'No PRC password set...' is actually a message that says cookie auth is working.  
> **username_1**: This doesn't actually describe how to use "cookie-based" authentication. Instead it describes how to use "rpcauth", which was not the question. This should not be the "accepted" answer.  
> **username_5**: For the record, the script `rpcauth.py` only works with python3.  
> **username_5**: Also you can give the password to `rpcauth.py` yourself by running it as `python3 /path/to/rpcauth.py myusername -`. The final `-` means the script will prompt you for the password. Works with bitcoin-core v0.18.  

---

### Answer by username_1 on 2018-11-13. Score: 4

The http remote procedure call (RPC) interface enforces ["basic access authentication"](https://en.wikipedia.org/wiki/Basic_access_authentication). "Cookie-based" authentication is misleading because it doesn't actually use [http cookies](https://en.wikipedia.org/wiki/HTTP_cookie). The short story is that on startup if you don't otherwise specify credentials via `rpcuser`+`rpcpassword`, bitcoind will write a file named ".cookie" in the data directory with contents "\_\_cookie\_\_:abc123" where \_\_cookie\_\_ is the basic auth username and abc123 is a randomly generated password. On shutdown, bitcoind deletes the file.

> **Comments:**
> **username_2**: "cookie" here isn't a reference to HTTP cookies, but to an authentication cookie, like for example X11 uses for authentication. I believe that use of the term cookie actually predates HTTP itself.  
> **username_1**: @username_2 I believe that use of the term cookie actually predates computers themselves :p Whatever it may mean elsewhere, in the context of an http interface, "cookie" is most naturally interpreted as "http cookie". If you don't believe me, give a dozen developers an http URL, a file named ".cookie", and the statement "its contents are used as authentication token", and see how many try to put the contents into a "Cookie" header. See also https://bitcoin.stackexchange.com/questions/43769/using-php-with-rpc-and-cookie  
> **username_2**: I meant the term cookie specifically in the meaning of "a file in the local filesystem a client can read to obtain an authentication token for a server running on the same system". It may be confusing to people who aren't familiar with the concept, but it certainly isn't a misnomer - it's the established name for that concept.  

---

### Answer by username_3 on 2018-01-28. Score: 3

In the recent version of Bitcoin Core, the name of script is `rpcauth.py` and its located in `./bitcoin/share/rpcauth/rpcauth.py` (available on [Bitcoin Core's github repository](http://github.com/bitcoin/bitcoin) as well, [share/rpcauth/rpcauth.py](https://github.com/bitcoin/bitcoin/blob/master/share/rpcauth/rpcauth.py)).


---

### Answer by username_4 on 2019-03-09. Score: 1

I was struggling with this same difficulty and managed to make it work. Obviously, bitcoin-cli must be made aware of credentials to use when making RPC calls, and I am guessing here that bitcoin-cli expects the credentials specified with variablies rpcuser and rpcpassword. However, these two variables are unnecessary to allow one to authenticate when making an RPC call via HTTP. So for bitcoin-cli's sake, bitcoind generates the .cookie file when rpcuser and rpcpassword are not defined in bitcoin.conf

Another thing I wanted to point out is that one can actually have a password of their choosing when using ./share/rpcauth/rpcauth.py to generate credentials. Simply pass to it two parameters as such `./share/rpcauth/rpcauth.py <username> <password>` and you'll have it.

> **Comments:**
> **username_5**: At the end of your first paragraph, I believe you meant to write `bitcoin.conf` instead of `bitcoin.info`.  
> **username_4**: Yes, most probably. Thanks for pointing that out.  

---

### Answer by username_6 on 2021-01-05. Score: 1

I did not happen to have a full implementation of bitcoin, but found the rpcauth.py script in the "share" directory under a litecoin build that I have. I seems to be coin agnostic and worked great!


---

### Answer by username_7 on 2019-05-07. Score: 0

i solved this for my Node by following lines in the Bitcoin.cfg after i started the client ( not the QT) with

-rpcuser=mynamewhateveryounameit

and in the Config i wrote

*Position of the Cookie = your Password)*
rpccookiefile=D:\Bitcoin\wallet.cookie

*allow not needed i guess for you are allways free to connect in your network but i did it anyway*
rpcallowip=127.0.0.1

*connection to the python proxy ( i use python-bitcoinrpc-master, much better then Python only*

from bitcoinrpc.authproxy import AuthServiceProxy

And thats all for the reason that it soon will be impossible to set your password or Username in the Config file.
dont know why, but it is like it is


---

### Answer by username_8 on 2022-11-19. Score: 0

This happened to me when my datadir was not in the default location of `/Users/nameHere/Library/Application Support/Bitcoin/bitcoin.conf`. bitcoin-cli needed an explicit command to locate it.

```
./src/bitcoin-cli -rpccookiefile="/Volumes/Bitcoin Core/.cookie" getblockchaininfo

```

Not ideal, would prefer is I could set this as an environment variable and have the cli pick it up from there. Have to check if that is possible.

> **Comments:**
> **username_9**: Do you have a Bitcoin Core Volume? Is that common as an Apple idiom, or is a way of yours?  

---

