Guides / Use node RPC safely
Use node RPC safely
A node's RPC interface can move funds and reveal wallet data. The coins are worthless on testnet, but the habits you build here are the ones that protect real money on mainnet.
On this page
Why it matters
RPC (Remote Procedure Call) is how you drive a node with commands. A wallet-enabled node can send coins, dump keys, and expose your balance over that interface. Testnet coins are worthless, so nothing here is at risk. But people have lost real funds to exposed wallet RPC on mainnet. Learn the safe pattern now, while mistakes are free.
The rules
- Bind to localhost only. Set
rpcbind=127.0.0.1and restrictrpcallowipto local addresses. Never bind to0.0.0.0. - Prefer cookie authentication. Let the node generate its
.cookiefile instead of putting anrpcpasswordin a config. If you must set a password, make it long and unique. - Never expose the RPC port. Don't port-forward it or open it in a firewall. If you need remote access, use an SSH tunnel to reach localhost securely.
- Disable the wallet when you don't need it. Run chain-only nodes with
-disablewallet, and keep wallet nodes separate from anything public-facing. - Firewall the ports and keep P2P and RPC straight. The P2P port is meant to be reachable by peers; the RPC port is not.
The one rule to never break
Never expose wallet RPC to the internet. Not on mainnet, and not "just for testing" on testnet, because the config you test with is the one you'll reuse.
A safe config
# litecoin.conf (safe defaults)
testnet=1
server=1
[test]
rpcbind=127.0.0.1
rpcallowip=127.0.0.1
# No rpcpassword line -> cookie auth is used automatically
# For a chain-only node, also add: disablewallet=1Ready to spin one up? See run a Litecoin testnet node and broadcasting a raw transaction.
Testnet coins are fake money
- They have no market value, so never buy or sell them.
- Never use a real seed phrase or import a real wallet on testnet.
- Never send mainnet BTC, LTC, or XMR to a testnet address.