Careful with this one — the root key isn't derived from the ...

⚡ Dee Kay ⚡

npub1e2yuky03caw4ke3zy68lg0fz3r4gkt94hx4fjmlelacyljgyk79svn3eef

hex

e7405d3b5bb4c2439f844b9fc29e226752b0ff733931fa58e115ac105a11c97f

nevent

nevent1qqswwsza8ddmfsjrn7zyh87znc3xw54slaenjv06trs3ttqstggujlcprpmhxue69uhhyetvv9ujuem4d36kwatvw5hx6mm9qgsv4zwtz8cuwh2mvc3zdrl5853g365t9j6mn25edlul7uz0eyzt0zcy03nhj

Kind-1 (TextNote)

2026-08-08T08:07:13Z

↳ Reply to Event not found

4b93e943ad9f130b8bf978a213fcd302b26cfe85c46252b19a64be15f35833b7...

Careful with this one — the root key isn't derived from the wallet seed. Per lnd/macaroons/README.md, it's "32 bytes of pseudo-random data" generated when none exists, stored in macaroons.db and encrypted with your wallet passphrase. The passphrase protects the key, it doesn't derive it.

LND also doesn't regenerate macaroons on restart — it only bakes the defaults when they're missing (lnd#7566). On my box the macaroon files were still dated Dec 2021 after 4½ years of restarts, an LND upgrade and an OS migration.

This matters because "restart regenerates them" implies a plain restart rotates your credentials. It doesn't — you'd walk away thinking you were safe while a stolen admin macaroon is still valid. Deleting macaroons.db is what forces a new random root key, and that's the whole point of the procedure. The old files are invalidated, but by deleting the db, not by restarting.

On BTCPay: with stock Umbrel wiring (macaroonfilepath=...), it re-reads the new file on restart — no re-linking needed. Mine reconnected with zero auth errors. You'd only need to re-link if you pasted the macaroon as hex, or you're connecting a remote BTCPay over Tor/LNC.

Raw JSON

{
  "kind": 1,
  "id": "e7405d3b5bb4c2439f844b9fc29e226752b0ff733931fa58e115ac105a11c97f",
  "pubkey": "ca89cb11f1c75d5b6622268ff43d2288ea8b2cb5b9aa996ff9ff704fc904b78b",
  "created_at": 1786176433,
  "tags": [
    [
      "e",
      "4b93e943ad9f130b8bf978a213fcd302b26cfe85c46252b19a64be15f35833b7",
      "wss://relay.primal.net/",
      "root",
      "c5684701cf97c5697ee38d30cba6e25bcebaecd2382bdd1a0ced44272d3fe5a6"
    ],
    [
      "p",
      "acbcec475a1a4f9481939ecfbd1c3d111f5b5a474a39ae039bbc720fdd305bec",
      "wss://haven.d11n.net/"
    ],
    [
      "p",
      "c5684701cf97c5697ee38d30cba6e25bcebaecd2382bdd1a0ced44272d3fe5a6",
      "wss://top.testrelay.top/"
    ],
    [
      "client",
      "Amethyst"
    ]
  ],
  "content": "Careful with this one — the root key isn't derived from the wallet seed. Per lnd/macaroons/README.md, it's \"32 bytes of pseudo-random data\" generated when none exists, stored in macaroons.db and encrypted with your wallet passphrase. The passphrase protects the key, it doesn't derive it.\n\nLND also doesn't regenerate macaroons on restart — it only bakes the defaults when they're missing (lnd#7566). On my box the macaroon files were still dated Dec 2021 after 4½ years of restarts, an LND upgrade and an OS migration.\n\nThis matters because \"restart regenerates them\" implies a plain restart rotates your credentials. It doesn't — you'd walk away thinking you were safe while a stolen admin macaroon is still valid. Deleting macaroons.db is what forces a new random root key, and that's the whole point of the procedure. The old files are invalidated, but by deleting the db, not by restarting.\n\nOn BTCPay: with stock Umbrel wiring (macaroonfilepath=...), it re-reads the new file on restart — no re-linking needed. Mine reconnected with zero auth errors. You'd only need to re-link if you pasted the macaroon as hex, or you're connecting a remote BTCPay over Tor/LNC.",
  "sig": "16b8c6511be62722b571a1a558ea5f8d3cb0bc6c9a9efc9d77843e0554a5e0666cfd743a2eba260fe4fb365ab9ea947f80518c0bade4c768d6dd518ff39bcb15"
}