Cookie based authentication is used when no rpc password is provided. The 0.12 release of Bitcoin Core had the following to say about it:
When no -rpcpassword is specified, the daemon now uses a special
‘cookie’ file for authentication. This file is generated with random
content when the daemon starts, and deleted when it exits. Its
contents are used as authentication token. Read access to this file
controls who can access through RPC. By default it is stored in the
data directory but its location can be overridden with the option
This is similar to Tor’s CookieAuthentication: see
This allows running bitcoind without having to do any manual
If all you use is
bitcoin-cli without need for the RPC user/password stuff, you should probably just comment out or remove
bitcoin.conf and restart bitcoin. It "should just work [tm]".
If you need a specified rpc user/pass combo, you need to switch to using
rpcauth instead of
rpcauth is described as
Username and hashed password for JSON-RPC connections. The field comes in the format:
<USERNAME>:<SALT>$<HASH>. A canonical python script is included in share/rpcuser. This option can be specified multiple times
share/rpcuser (on github) there is a Python script which lets you create such a user/password combo (note that you are given the password, you do not get to specify it yourself).
Grab that python script, then run it. E.g.
$ python ./rpcuser.py foo
String to be appended to bitcoin.conf:
VX3z87LBVc_X7NBLABLABLABLA wherever you are connecting to the bitcoind RPC.