SignMessage

SignMessage signs a message with the key specified in the key locator. The returned signature is fixed-size LN wire format encoded.

The main difference to SignMessage in the main RPC is that a specific key is used to sign the message instead of the node identity private key.

Source: signrpc/signer.proto

gRPC

rpc SignMessage (SignMessageReq) returns (SignMessageResp);

REST

HTTP Method	Path
POST	/v2/signer/signmessage

Code Samples

gRPC

Javascript

const fs = require('fs');
const grpc = require('@grpc/grpc-js');
const protoLoader = require('@grpc/proto-loader');

const GRPC_HOST = 'localhost:10009'
const MACAROON_PATH = 'LND_DIR/data/chain/bitcoin/regtest/admin.macaroon'
const TLS_PATH = 'LND_DIR/tls.cert'

const loaderOptions = {
  keepCase: true,
  longs: String,
  enums: String,
  defaults: true,
  oneofs: true,
};
const packageDefinition = protoLoader.loadSync(['lightning.proto', 'signrpc/signer.proto'], loaderOptions);
const signrpc = grpc.loadPackageDefinition(packageDefinition).signrpc;
process.env.GRPC_SSL_CIPHER_SUITES = 'HIGH+ECDSA';
const tlsCert = fs.readFileSync(TLS_PATH);
const sslCreds = grpc.credentials.createSsl(tlsCert);
const macaroon = fs.readFileSync(MACAROON_PATH).toString('hex');
const macaroonCreds = grpc.credentials.createFromMetadataGenerator(function(args, callback) {
  let metadata = new grpc.Metadata();
  metadata.add('macaroon', macaroon);
  callback(null, metadata);
});
let creds = grpc.credentials.combineChannelCredentials(sslCreds, macaroonCreds);
let client = new signrpc.Signer(GRPC_HOST, creds);
let request = {
  msg: <bytes>,
  key_loc: <KeyLocator>,
  double_hash: <bool>,
  compact_sig: <bool>,
  schnorr_sig: <bool>,
  schnorr_sig_tap_tweak: <bytes>,
};
client.signMessage(request, function(err, response) {
  console.log(response);
});
// Console output:
//  {
//    "signature": <bytes>,
//  }

Python

import codecs, grpc, os
# Generate the following 2 modules by compiling the signrpc/signer.proto with the grpcio-tools.
# See https://github.com/lightningnetwork/lnd/blob/master/docs/grpc/python.md for instructions.
import signer_pb2 as signrpc, signer_pb2_grpc as signerstub

GRPC_HOST = 'localhost:10009'
MACAROON_PATH = 'LND_DIR/data/chain/bitcoin/regtest/admin.macaroon'
TLS_PATH = 'LND_DIR/tls.cert'

# create macaroon credentials
macaroon = codecs.encode(open(MACAROON_PATH, 'rb').read(), 'hex')
def metadata_callback(context, callback):
  callback([('macaroon', macaroon)], None)
auth_creds = grpc.metadata_call_credentials(metadata_callback)
# create SSL credentials
os.environ['GRPC_SSL_CIPHER_SUITES'] = 'HIGH+ECDSA'
cert = open(TLS_PATH, 'rb').read()
ssl_creds = grpc.ssl_channel_credentials(cert)
# combine macaroon and SSL credentials
combined_creds = grpc.composite_channel_credentials(ssl_creds, auth_creds)
# make the request
channel = grpc.secure_channel(GRPC_HOST, combined_creds)
stub = signerstub.SignerStub(channel)
request = signrpc.SignMessageReq(
  msg=<bytes>,
  key_loc=<KeyLocator>,
  double_hash=<bool>,
  compact_sig=<bool>,
  schnorr_sig=<bool>,
  schnorr_sig_tap_tweak=<bytes>,
)
response = stub.SignMessage(request)
print(response)
# {
#    "signature": <bytes>,
# }

REST

Javascript

const fs = require('fs');
const request = require('request');

const REST_HOST = 'localhost:8080'
const MACAROON_PATH = 'LND_DIR/data/chain/bitcoin/regtest/admin.macaroon'

let requestBody = {
  msg: <string>, // <bytes> (base64 encoded)
  key_loc: <object>, // <KeyLocator> 
  double_hash: <boolean>, // <bool> 
  compact_sig: <boolean>, // <bool> 
  schnorr_sig: <boolean>, // <bool> 
  schnorr_sig_tap_tweak: <string>, // <bytes> (base64 encoded)
};
let options = {
  url: `https://${REST_HOST}/v2/signer/signmessage`,
  // Work-around for self-signed certificates.
  rejectUnauthorized: false,
  json: true,
  headers: {
    'Grpc-Metadata-macaroon': fs.readFileSync(MACAROON_PATH).toString('hex'),
  },
  form: JSON.stringify(requestBody),
}
request.post(options, function(error, response, body) {
  console.log(body);
});
// Console output:
//  {
//    "signature": <string>, // <bytes> 
//  }

Python

import base64, codecs, json, requests

REST_HOST = 'localhost:8080'
MACAROON_PATH = 'LND_DIR/data/chain/bitcoin/regtest/admin.macaroon'
TLS_PATH = 'LND_DIR/tls.cert'

url = f'https://{REST_HOST}/v2/signer/signmessage'
macaroon = codecs.encode(open(MACAROON_PATH, 'rb').read(), 'hex')
headers = {'Grpc-Metadata-macaroon': macaroon}
data = {
  'msg': base64.b64encode(<bytes>),
  'key_loc': <KeyLocator>,
  'double_hash': <bool>,
  'compact_sig': <bool>,
  'schnorr_sig': <bool>,
  'schnorr_sig_tap_tweak': base64.b64encode(<bytes>),
}
r = requests.post(url, headers=headers, data=json.dumps(data), verify=TLS_PATH)
print(r.json())
# {
#    "signature": <bytes>,
# }

Shell

# There is no CLI command for this RPC

Messages

signrpc.SignMessageReq

Source: signrpc/signer.proto

Field	gRPC Type	REST Type	REST Placement
msg The message to be signed. When using REST, this field must be encoded as base64.	bytes	string	body
key_loc The key locator that identifies which key to use for signing.	KeyLocator	object	body
double_hash Double-SHA256 hash instead of just the default single round.	bool	boolean	body
compact_sig Use the compact (pubkey recoverable) format instead of the raw lnwire format. This option cannot be used with Schnorr signatures.	bool	boolean	body
schnorr_sig Use Schnorr signature. This option cannot be used with compact format.	bool	boolean	body
schnorr_sig_tap_tweak The optional Taproot tweak bytes to apply to the private key before creating a Schnorr signature. The private key is tweaked as described in BIP-341: privKey + h_tapTweak(internalKey || tapTweak)	bytes	string	body

signrpc.SignMessageResp

Source: signrpc/signer.proto

Field	gRPC Type	REST Type
signature The signature for the given message in the fixed-size LN wire format.	bytes	string

Nested Messages

signrpc.KeyLocator

Field	gRPC Type	REST Type
key_family The family of key being identified.	int32	integer
key_index The precise index of the key being identified.	int32	integer