1# PSBT Howto for Bitcoin Core 2 3Since Bitcoin Core 0.17, an RPC interface exists for Partially Signed Bitcoin 4Transactions (PSBTs, as specified in 5[BIP 174](https://github.com/bitcoin/bips/blob/master/bip-0174.mediawiki)). 6 7This document describes the overall workflow for producing signed transactions 8through the use of PSBT, and the specific RPC commands used in typical 9scenarios. 10 11## PSBT in general 12 13PSBT is an interchange format for Bitcoin transactions that are not fully signed 14yet, together with relevant metadata to help entities work towards signing it. 15It is intended to simplify workflows where multiple parties need to cooperate to 16produce a transaction. Examples include hardware wallets, multisig setups, and 17[CoinJoin](https://bitcointalk.org/?topic=279249) transactions. 18 19### Overall workflow 20 21Overall, the construction of a fully signed Bitcoin transaction goes through the 22following steps: 23 24- A **Creator** proposes a particular transaction to be created. They construct 25 a PSBT that contains certain inputs and outputs, but no additional metadata. 26- For each input, an **Updater** adds information about the UTXOs being spent by 27 the transaction to the PSBT. They also add information about the scripts and 28 public keys involved in each of the inputs (and possibly outputs) of the PSBT. 29- **Signers** inspect the transaction and its metadata to decide whether they 30 agree with the transaction. They can use amount information from the UTXOs 31 to assess the values and fees involved. If they agree, they produce a 32 partial signature for the inputs for which they have relevant key(s). 33- A **Finalizer** is run for each input to convert the partial signatures and 34 possibly script information into a final `scriptSig` and/or `scriptWitness`. 35- An **Extractor** produces a valid Bitcoin transaction (in network format) 36 from a PSBT for which all inputs are finalized. 37 38Generally, each of the above (excluding Creator and Extractor) will simply 39add more and more data to a particular PSBT, until all inputs are fully signed. 40In a naive workflow, they all have to operate sequentially, passing the PSBT 41from one to the next, until the Extractor can convert it to a real transaction. 42In order to permit parallel operation, **Combiners** can be employed which merge 43metadata from different PSBTs for the same unsigned transaction. 44 45The names above in bold are the names of the roles defined in BIP174. They're 46useful in understanding the underlying steps, but in practice, software and 47hardware implementations will typically implement multiple roles simultaneously. 48 49## PSBT in Bitcoin Core 50 51### RPCs 52 53- **`converttopsbt` (Creator)** is a utility RPC that converts an 54 unsigned raw transaction to PSBT format. It ignores existing signatures. 55- **`createpsbt` (Creator)** is a utility RPC that takes a list of inputs and 56 outputs and converts them to a PSBT with no additional information. It is 57 equivalent to calling `createrawtransaction` followed by `converttopsbt`. 58- **`walletcreatefundedpsbt` (Creator, Updater)** is a wallet RPC that creates a 59 PSBT with the specified inputs and outputs, adds additional inputs and change 60 to it to balance it out, and adds relevant metadata. In particular, for inputs 61 that the wallet knows about (counting towards its normal or watch-only 62 balance), UTXO information will be added. For outputs and inputs with UTXO 63 information present, key and script information will be added which the wallet 64 knows about. It is equivalent to running `createrawtransaction`, followed by 65 `fundrawtransaction`, and `converttopsbt`. 66- **`walletprocesspsbt` (Updater, Signer, Finalizer)** is a wallet RPC that takes as 67 input a PSBT, adds UTXO, key, and script data to inputs and outputs that miss 68 it, and optionally signs inputs. Where possible it also finalizes the partial 69 signatures. 70- **`utxoupdatepsbt` (Updater)** is a node RPC that takes a PSBT and updates it 71 to include information available from the UTXO set (works only for SegWit 72 inputs). 73- **`finalizepsbt` (Finalizer, Extractor)** is a utility RPC that finalizes any 74 partial signatures, and if all inputs are finalized, converts the result to a 75 fully signed transaction which can be broadcast with `sendrawtransaction`. 76- **`combinepsbt` (Combiner)** is a utility RPC that implements a Combiner. It 77 can be used at any point in the workflow to merge information added to 78 different versions of the same PSBT. In particular it is useful to combine the 79 output of multiple Updaters or Signers. 80- **`joinpsbts`** (Creator) is a utility RPC that joins multiple PSBTs together, 81 concatenating the inputs and outputs. This can be used to construct CoinJoin 82 transactions. 83- **`decodepsbt`** is a diagnostic utility RPC which will show all information in 84 a PSBT in human-readable form, as well as compute its eventual fee if known. 85- **`analyzepsbt`** is a utility RPC that examines a PSBT and reports the 86 current status of its inputs, the next step in the workflow if known, and if 87 possible, computes the fee of the resulting transaction and estimates the 88 final weight and feerate. 89 90 91### Workflows 92 93#### Multisig with multiple Bitcoin Core instances 94 95Alice, Bob, and Carol want to create a 2-of-3 multisig address. They're all using 96Bitcoin Core. We assume their wallets only contain the multisig funds. In case 97they also have a personal wallet, this can be accomplished through the 98multiwallet feature - possibly resulting in a need to add `-rpcwallet=name` to 99the command line in case `bitcoin-cli` is used. 100 101Setup: 102- All three call `getnewaddress` to create a new address; call these addresses 103 *Aalice*, *Abob*, and *Acarol*. 104- All three call `getaddressinfo "X"`, with *X* their respective address, and 105 remember the corresponding public keys. Call these public keys *Kalice*, 106 *Kbob*, and *Kcarol*. 107- All three now run `addmultisigaddress 2 ["Kalice","Kbob","Kcarol"]` to teach 108 their wallet about the multisig script. Call the address produced by this 109 command *Amulti*. They may be required to explicitly specify the same 110 addresstype option each, to avoid constructing different versions due to 111 differences in configuration. 112- They also run `importaddress "Amulti" "" false` to make their wallets treat 113 payments to *Amulti* as contributing to the watch-only balance. 114- Others can verify the produced address by running 115 `createmultisig 2 ["Kalice","Kbob","Kcarol"]`, and expecting *Amulti* as 116 output. Again, it may be necessary to explicitly specify the addresstype 117 in order to get a result that matches. This command won't enable them to 118 initiate transactions later, however. 119- They can now give out *Amulti* as address others can pay to. 120 121Later, when *V* BTC has been received on *Amulti*, and Bob and Carol want to 122move the coins in their entirety to address *Asend*, with no change. Alice 123does not need to be involved. 124- One of them - let's assume Carol here - initiates the creation. She runs 125 `walletcreatefundedpsbt [] {"Asend":V} 0 {"subtractFeeFromOutputs":[0], "includeWatching":true}`. 126 We call the resulting PSBT *P*. *P* does not contain any signatures. 127- Carol needs to sign the transaction herself. In order to do so, she runs 128 `walletprocesspsbt "P"`, and gives the resulting PSBT *P2* to Bob. 129- Bob inspects the PSBT using `decodepsbt "P2"` to determine if the transaction 130 has indeed just the expected input, and an output to *Asend*, and the fee is 131 reasonable. If he agrees, he calls `walletprocesspsbt "P2"` to sign. The 132 resulting PSBT *P3* contains both Carol's and Bob's signature. 133- Now anyone can call `finalizepsbt "P3"` to extract a fully signed transaction 134 *T*. 135- Finally anyone can broadcast the transaction using `sendrawtransaction "T"`. 136 137In case there are more signers, it may be advantageous to let them all sign in 138parallel, rather than passing the PSBT from one signer to the next one. In the 139above example this would translate to Carol handing a copy of *P* to each signer 140separately. They can then all invoke `walletprocesspsbt "P"`, and end up with 141their individually-signed PSBT structures. They then all send those back to 142Carol (or anyone) who can combine them using `combinepsbt`. The last two steps 143(`finalizepsbt` and `sendrawtransaction`) remain unchanged. 144