skills.rest
lightninglabs
lightninglabsOFFICIAL
Explore all skills by this author →
GitHub

macaroon-bakery

Bake, inspect, and rotate scoped lnd macaroons for least-privilege agent access.

57|18|Updated Feb 6, 2026
Search Tags:#docker#credentials#least-privilege#lnd#macaroon#lightning-network
One-click install
npx skills add https://github.com/lightninglabs/lightning-agent-tools --skill macaroon-bakery
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: macaroon-bakery
Source: https://github.com/lightninglabs/lightning-agent-tools/tree/main/skills/macaroon-bakery
Command: npx skills add https://github.com/lightninglabs/lightning-agent-tools --skill macaroon-bakery

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires docker, jq, lncli, and includes scripts (resource) components.

What problem does it solve?

It replaces unsafe, over-privileged shared credentials with scoped macaroons so agents can interact with lnd using only the permissions they need.

Core Features & Use Cases

  • Bakes preset roles such as pay-only, invoice-only, read-only, channel-admin, and signer-only.
  • Supports custom permission sets, macaroon inspection, permission discovery, and rotation workflows.
  • Works with local nodes, Docker containers, and remote lnd endpoints for production and testing.
  • Example: provision a pay-only macaroon for a payment agent instead of handing out admin access.

Quick Start

Use the macaroon-bakery skill to bake a pay-only macaroon for your lnd node and save it to a secure path.

Frequently Asked Questions about macaroon-bakery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create scoped lnd macaroons for least-privilege access?▼

Scoped lnd macaroons are created by baking permission-restricted bearer tokens using lncli. You can generate preset roles like pay-only, invoice-only, read-only, channel-admin, and signer-only, or define custom permission sets to limit node access.

Why should I use scoped macaroons instead of sharing full admin lnd credentials?▼

Scoped macaroons prevent over-privileged access by restricting agents to only the permissions they need. Instead of handing out admin credentials, you bake specific tokens for tasks like payments or invoicing, significantly reducing security risks.

Can I bake lnd macaroons for a Docker container or remote node?▼

Yes, lnd macaroon baking supports local nodes, Docker containers, and remote lnd endpoints. This allows you to provision and rotate scoped tokens across production and testing environments.

What do I need to inspect and discover lnd macaroon permissions?▼

To inspect lnd macaroon permissions and discover available scopes, you need lncli for node access and jq for parsing permission data. This setup allows you to audit and verify bearer tokens safely.

Does macaroon rotation work with custom permission sets on the lightning network?▼

Yes, macaroon rotation workflows support custom permission sets alongside preset roles. You can bake, inspect, and rotate scoped tokens for the lightning network to maintain secure least-privilege access for your agents.

Related Skills

Explore More Software Engineering Skills→
TitoPrauseeTitoPrausee

tailscale-docker

Configure Tailscale in Docker containers using userspace networking and SOCKS5 proxy.

Community
Intermediate
heaptracetechnologyheaptracetechnology
13

Manage Secrets

Manage AWS application secrets with SSM Parameter Store and Secrets Manager.

Community
Advanced
phrazzldphrazzld
13

lightning

Manage LND node lifecycle by auditing channels, planning liquidity, and verifying payments.

Community
Advanced
lightninglabslightninglabs
57

lightning-security-module

Separate Lightning private keys from agent-controlled machines via remote signer setup.

Official
Advanced