The transaction only has one input, where its scriptPubKey is --> Op_1 Q , where Q is the tweaked public key.

Let p = private key, P = Public key, q = p + tweak, Q = tweaked Public key

To create the transaction you have to populate the witness field:

  1. Key Path Spend: Do you use q (the tweaked private key) to sign the transaction?

    That is, s = k + H(R,Q, txdata)q and sig is (R,s) where k is the nonce

  2. Script Path Spend: Do you use p (untweaked internal private key) to sign the transaction

    That is, s = q + h(Q,P, txdata)p and sig is (Q,s) where q is now the nonce

I am not a coder so trying to find the answer to this has been difficult given that I think you would need to code to understand how the mechanics works.

  • Vojtěch - I appreciate the quick response and the link to BIP341. I read the article (several times) and I can say that I now finally understand Taproot. However, it was your comment about the keys used to sign a Script Path Spend transaction, are the ones in the executed scripts that actually made it all clear to me. I am not sure why it didn't click in my head previously, as its seems so obvious now.
    – J S
    Commented Feb 7 at 0:00

1 Answer 1


In a key path spend, you always sign with the private key corresponding to the output key. If that key is a tweaked public key (it's recommended to always use a tweaked key), you will also need to tweak the private key.

In a script path spend, the internal (untweaked) key is used to prove the committment to a script tree. The actual script will contain its own public keys that may be unrelated to the internal or output key, and producing signatures for them will require their corresponding private keys.

You may wish to read BIP341: Script validation rules to make sure you understand how exactly Taproot inputs are validated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.