Map Bitcoin watch-only and external-signer wallet roles

Separate seeing funds from authorizing a spend

A wallet interface can display addresses and balances without controlling private keys. Before relying on a wallet for a payment, identify whether it can sign, delegates signing to hardware or only observes the blockchain.

Bitcoin Core 31.0 documents wallet creation options for disabling private keys, descriptors, encryption, address-reuse tracking and external signers. Define the limit by inflow, duration and reset rule before entering a number. For Classify private-key capability, preserve wallet beside key capability and do not close the question until descriptor source is independently checked. Review the account history on a fixed schedule rather than after a loss.

Classify private-key capability

The disable_private_keys option creates a wallet where only watch-only functions are possible. Record whether the wallet has keys, imported descriptors or observation-only data. Keep deposits, withdrawals, losses and account balance in separate fields. A useful wallet authority map links status to Identify the external signer, names the origin of signer and explains why connection is still relevant. The working row is wallet, key capability, descriptor source and status; its heading is classify private-key capability, and its place in the larger record is wallet authority map.

A visible balance does not prove that the wallet can spend it. Test a decrease immediately and record when an increase would take effect. When key capability and Identify the external signer disagree, retain both observations, recheck Classify private-key capability and postpone any decision that depends on signer. Record whether the wallet has keys, imported descriptors or observation-only data. For this classify private-key capability decision, compare wallet, key capability, descriptor source and status with wallet authority map and retain the dated mismatch instead of forcing agreement.

Identify the external signer

External-signer mode depends on a configured signing device and requires compatible wallet settings. Name the hardware role and connection method without recording seed material. Test a decrease immediately and record when an increase would take effect. When key capability and Identify the external signer disagree, retain both observations, recheck Classify private-key capability and postpone any decision that depends on signer. The working row is signer, connection, wallet setting, firmware and test; its heading is identify the external signer, and its place in the larger record is wallet authority map.

Do not assume a connected device has reviewed the correct address or amount. Treat a limit as one control inside a wider spending plan. The reviewer should reproduce descriptor source from status, identify the unit attached to wallet and see the collection time for connection. Name the hardware role and connection method without recording seed material. For this identify the external signer decision, compare signer, connection, wallet setting, firmware and test with wallet authority map and retain the dated mismatch instead of forcing agreement.

Review encryption

A passphrase can encrypt a signing wallet but does not replace a secure backup. Document whether encryption is enabled and where the recovery procedure is stored. Treat a limit as one control inside a wider spending plan. The reviewer should reproduce descriptor source from status, identify the unit attached to wallet and see the collection time for connection. The working row is encryption status, backup, custodian, test and date; its heading is review encryption, and its place in the larger record is wallet authority map.

Never put the passphrase in the same note as the wallet backup. Review the account history on a fixed schedule rather than after a loss. Finish the row by stating who will verify signer, which source governs key capability and what change would make Identify the external signer obsolete. Document whether encryption is enabled and where the recovery procedure is stored. For this review encryption decision, compare encryption status, backup, custodian, test and date with wallet authority map and retain the dated mismatch instead of forcing agreement.

Check address-reuse controls

The avoid_reuse flag tracks previously used coins and can affect wallet behaviour. Record the setting and the privacy goal it supports. Review the account history on a fixed schedule rather than after a loss. Finish the row by stating who will verify signer, which source governs key capability and what change would make Identify the external signer obsolete. The working row is avoid-reuse status, labels, prior use, limitation and review; its heading is check address-reuse controls, and its place in the larger record is wallet authority map.

A setting cannot undo privacy already lost through reused addresses. Define the limit by inflow, duration and reset rule before entering a number. For Classify private-key capability, preserve wallet beside key capability and do not close the question until descriptor source is independently checked. Record the setting and the privacy goal it supports. For this check address-reuse controls decision, compare avoid-reuse status, labels, prior use, limitation and review with wallet authority map and retain the dated mismatch instead of forcing agreement.

Run a no-funds rehearsal

A new receiving address and signing preview can be tested without broadcasting value. Compare displayed addresses across the wallet and external signer. Define the limit by inflow, duration and reset rule before entering a number. For Classify private-key capability, preserve wallet beside key capability and do not close the question until descriptor source is independently checked. The working row is test address, wallet display, signer display, result and next step; its heading is run a no-funds rehearsal, and its place in the larger record is wallet authority map.

Stop when displays disagree; do not use real money to diagnose the mismatch. Keep deposits, withdrawals, losses and account balance in separate fields. A useful wallet authority map links status to Identify the external signer, names the origin of signer and explains why connection is still relevant. Compare displayed addresses across the wallet and external signer. For this run a no-funds rehearsal decision, compare test address, wallet display, signer display, result and next step with wallet authority map and retain the dated mismatch instead of forcing agreement.

Use Bitcoin Core fields to name wallet authority

The RPC documentation gives precise meanings to wallet modes that consumer interfaces may describe less explicitly. The reviewer should reproduce descriptor source from status, identify the unit attached to wallet and see the collection time for connection. Keep deposits, withdrawals, losses and account balance in separate fields. Use SignalBet guides only to clarify Classify private-key capability or wallet; the named source remains responsible for key capability and descriptor source.

It does not evaluate a third-party hardware wallet, receiving service or the legal suitability of a payment. Finish the row by stating who will verify signer, which source governs key capability and what change would make Identify the external signer obsolete. Test a decrease immediately and record when an increase would take effect. That limit keeps status distinct from Identify the external signer and prevents signer from being stretched into a claim about connection.

Use each wallet only for its documented role

The map should make clear which component observes, which stores keys and which signs before a transaction is prepared. A useful wallet authority map links status to Identify the external signer, names the origin of signer and explains why connection is still relevant. Treat a limit as one control inside a wider spending plan. A completed wallet authority map should leave Classify private-key capability traceable, descriptor source bounded and signer ready for its next dated review.

Keep payment funds limited to the intended task and never use essential or borrowed money. Adults 18+ who meet local law should treat gambling as optional entertainment rather than income or debt recovery, protect essential money, set cash and time limits before play, never borrow or chase losses, and use the responsible-play centre for blocking, time-out, self-exclusion and confidential support. When key capability and Identify the external signer disagree, retain both observations, recheck Classify private-key capability and postpone any decision that depends on signer. Review the account history on a fixed schedule rather than after a loss.