<p>Bitcoin-Cores RPC API is not meant to be available on the public internet. It's not hardened enough and the authentication (HTTP BASE AUTH) is <strong>not</strong> safe.</p>

<p>If you want to connect to the RPC-API over the internet, you have a couple of options...</p>

<ul>
<li>use VPN (openVPN, etc.)</li>
<li>use stunnel</li>
<li>use Apache with a reverse proxy and enable SSL (probably most easy to setup)</li>
</ul>

<p>Also have a look at the 0.12 release notes:
<a href="https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-0.12.0.md#rpc-ssl-support-dropped" rel="nofollow">https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-0.12.0.md#rpc-ssl-support-dropped</a></p>

CC BY-SA 3.0
2016-06-09T07:22:29.470Z
2016-06-09T09:55:01.150Z
2016-06-09T09:55:01.150Z
Jonas Schnelli
<p>When using an API to operate Bitcoin QT remotely, which security concerns should I be most worried about?</p>

<bitcoin-core><api>
Primary security risks of Bitcoin QT API use
Nancy Smith
# Primary security risks of Bitcoin QT API use

(Asked by: username_0 on 2016-06-08)

When using an API to operate Bitcoin QT remotely, which security concerns should I be most worried about?

**Tags:** bitcoin-core, api


---

## 1 answers

### Answer by username_1 on 2016-06-09. Score: 2 | Accepted answer

Bitcoin-Cores RPC API is not meant to be available on the public internet. It's not hardened enough and the authentication (HTTP BASE AUTH) is **not** safe.

If you want to connect to the RPC-API over the internet, you have a couple of options...

* use VPN (openVPN, etc.)
* use stunnel
* use Apache with a reverse proxy and enable SSL (probably most easy to setup)

Also have a look at the 0.12 release notes:
<https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-0.12.0.md#rpc-ssl-support-dropped>


---

