Recall taproot has two ways to spend, the key path and the script path. Let's focus on the key path. It's the easy, straightforward one. We cover the script path in the next chapter.

Back in Pay to Taproot we ended with a tweaked key:

and we said the tweak is a hash:

so:

There are two things in this equation to pin down.

First: the data

The data will be a merkle root later, which we cover in the next chapter (the script tree). We're not interested in it for the moment, so for now the data is empty. With no data, the tweak is just:

We only want a taproot output we can spend with a public key (key spend). We spend it by signing with the tweaked private key $x + t$, like a normal single-key output.

Second: the hash

Look at the hash we use for the tweak, $t = \text{hash}(P \, || \, \text{data})$. In Pay to Taproot we hashed with plain sha256 ($\text{hash} = \text{sha256}$).

Taproot does not. It uses the tagged hash we met in Schnorr & BIP340. So our tweaked key is:

Next we build this tweak in full.