Connect monero-wallet-cli & monero-wallet-rpc to mnr

monero-wallet-cli and monero-wallet-rpc are the official command-line tools and backend daemon clients for Monero. They are used by terminal power users, merchants, automated payment gateways, and backend services. This guide covers connecting CLI and RPC services to mnr with SSL certificate verification, authentication, and Tor/I2P proxying.

Quick command

Launch monero-wallet-cli with TLS and authentication:

monero-wallet-cli \
  --daemon-address rpc.mnr.network:443 \
  --daemon-login <token>:x \
  --daemon-ssl enabled \
  --daemon-ssl-ca-certificates /etc/ssl/certs/ca-certificates.crt \
  --daemon-ssl-allow-chained

Important: Put your token in the username part of --daemon-login <token>:x. Stock Monero CLI authenticates using HTTP Digest auth; mnr checks the token from the username and ignores the password.

CA Certificate Bundles by Operating System

When --daemon-ssl enabled is passed, monero-wallet-cli strictly requires a CA bundle to authenticate the server's certificate. Point --daemon-ssl-ca-certificates to your system's certificate path, and pass --daemon-ssl-allow-chained with it: without that flag wallet2 uses the file as a pin on a single certificate rather than as a list of authorities, and every connection fails with certificate verify failed. Verified against this endpoint with v0.18.5.1.

--daemon-ssl-allow-any-cert bypasses certificate validation. Use it only for temporary diagnostic testing if your local CA bundle is misconfigured.

Two alternatives, both tested against this endpoint:

• Pin the fingerprint instead of trusting a CA. Our edge certificate is replaced periodically, so re-read it when the handshake starts failing:

  FP=$(openssl s_client -connect rpc.mnr.network:443 -servername rpc.mnr.network </dev/null 2>/dev/null \
       | openssl x509 -noout -fingerprint -sha256 | sed 's/.*=//; s/://g')
  monero-wallet-cli --daemon-address rpc.mnr.network:443 --daemon-login <token>:x \
    --daemon-ssl enabled --daemon-ssl-allowed-fingerprints "$FP"
  

• Use the onion, where the address is the identity and no certificate is involved:

  monero-wallet-cli --proxy 127.0.0.1:9050 \
    --daemon-address mnrrpcvbopaykx7um32r4iyamontteidypjd33fhzvuy2hwfu5c4ifad.onion:80 \
    --daemon-login <token>:x
  

Connecting monero-wallet-rpc (Backends & Merchants)

For automated payment services, crypto payment processors, or multi-user backend daemons:

monero-wallet-rpc \
  --daemon-address rpc.mnr.network:443 \
  --daemon-login <token>:x \
  --daemon-ssl enabled \
  --daemon-ssl-ca-certificates /etc/ssl/certs/ca-certificates.crt \
  --daemon-ssl-allow-chained \
  --wallet-file /var/monero/wallets/merchant.wallet \
  --password-file /var/monero/wallets/merchant.pass \
  --rpc-bind-port 18082 \
  --disable-rpc-login

Path-form for direct JSON-RPC scripts:

If you are querying the Monero daemon directly from Python, Node.js, Go, or cURL without a wallet binary, use the direct path token endpoint:

curl -s -X POST https://rpc.mnr.network/v1/<token>/json_rpc \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":"0","method":"get_info"}'

Tor & I2P Routing

To run completely isolated from clearnet and DNS leakage:

Over Tor (.onion)

monero-wallet-cli \
  --daemon-address mnrrpcvbopaykx7um32r4iyamontteidypjd33fhzvuy2hwfu5c4ifad.onion:80 \
  --daemon-login <token>:x \
  --proxy 127.0.0.1:9050

Over I2P

monero-wallet-cli \
  --daemon-address misxlqjfq3wshjbn47fhzaqiagavaow2mgbfqrvxzdlybm7xtbvq.b32.i2p \
  --daemon-login <token>:x \
  --proxy 127.0.0.1:4447

What the Mnr-* Response Headers Mean

Every response from mnr includes verification metadata headers indicating how the data was checked:

curl -si -X POST https://rpc.mnr.network/v1/<token>/get_height -d '{}' | grep -i ^mnr-

• Mnr-Verify: majority: Consensus state verified against ≥3 independent upstream nodes.
• Mnr-Verify: hash-match: Block or transaction recomputed from raw bytes and verified against header chain / txid.
• Mnr-Agreeing: 5/5: Number of healthy nodes in consensus.
• Mnr-Cache: hit | miss: SWR cache status.
• Mnr-Tier: free | pro: Tier associated with the active token.

Troubleshooting

• Error: "SSL certificate verify failed": The usual cause is a missing --daemon-ssl-allow-chained next to --daemon-ssl-ca-certificates; without it the file is treated as a pin, not a CA list. Otherwise verify the path points to a valid file on disk. Run ls -l <path> to check existence.
• Error: "Bad server response for authentication": The token was passed in the password slot (--daemon-login user:<token>). Correct it to --daemon-login <token>:x.
• Error: 401 Unauthorized: The token is invalid, rotated, or expired. Obtain a new one at mnr.network/get-token/.
• Error: 429 Too Many Requests: Request throughput exceeded burst rate limit (5 req/s on Free tier). Use a Pro token for 25 req/s or slow down wallet sync threads.

What a sync from scratch looks like

We synced a fresh monero-wallet-cli from height 1 to the tip through rpc.mnr.network on 6–7 September 2026 (3.76 million blocks): about 29 hours wall clock, 36 blocks per second on average, slower near the tip where blocks are dense, and it finished with zero errors. The run survived eight relay restarts on our side; the wallet resumes from its checkpoint each time.

Two things to know before you do the same:

• Work units. A full sync from scratch is roughly 770,000 WU, more than a Free month's 500,000. Use a Pro token, or a restore height near the wallet's creation, which is what a normal restore does anyway.
• Parallel fetch. The CLI fetches blocks with as many parallel connections as your machine has cores. A Pro token allows three concurrent block streams, so pass --max-concurrency 3; without it the extra connections are refused and retried, which costs time, not correctness.