slips

SLIP-82

Schnorr Auth (NIP-98)

draft optional author:melvincarvalho

Status Implemented in JSS
Draft ✅ Yes (v0.0.22+)

This SLIP describes HTTP authentication using Schnorr signatures, compatible with Nostr NIP-98. It enables passwordless, multi-user authentication using secp256k1 keypairs.

Overview

Users authenticate by signing an HTTP Auth event (kind 27235) with their Nostr private key. The signed event is base64-encoded and sent in the Authorization header. Servers verify the signature and extract the user’s identity as did:nostr:<pubkey>.

Event Structure

The authentication event follows NIP-98:

{
  "id": "<sha256 hash of serialized event>",
  "pubkey": "<64-char lowercase hex public key>",
  "created_at": 1234567890,
  "kind": 27235,
  "tags": [
    ["u", "https://example.com/resource"],
    ["method", "GET"]
  ],
  "content": "",
  "sig": "<schnorr signature>"
}

Required Tags

Tag Description
u The absolute URL being accessed
method The HTTP method (GET, PUT, DELETE, etc.)

Optional Tags

Tag Description
payload SHA256 hash of request body (for PUT/POST)

Authorization Header

The signed event is base64-encoded and sent as:

Authorization: Nostr <base64-encoded-event>

Server Validation

Servers MUST:

  1. Decode the base64 event
  2. Verify event.id matches SHA256 of serialized event
  3. Verify event.sig is valid Schnorr signature for event.pubkey
  4. Verify created_at is within acceptable window (e.g., 60 seconds)
  5. Verify u tag matches the requested URL
  6. Verify method tag matches the HTTP method

On success, the authenticated identity is: did:nostr:<event.pubkey>

Example

Request:

GET /alice/profile HTTP/1.1
Host: example.com
Authorization: Nostr eyJpZCI6IjEyMzQ...

Decoded event:

{
  "id": "1234abcd...",
  "pubkey": "f0af1228a863772c0661ca0dd2586c58668de52ca9f71973404e7b9b1f5edc4d",
  "created_at": 1703123456,
  "kind": 27235,
  "tags": [
    ["u", "https://example.com/alice/profile"],
    ["method", "GET"]
  ],
  "content": "",
  "sig": "abcd1234..."
}

Authenticated identity: did:nostr:f0af1228a863772c0661ca0dd2586c58668de52ca9f71973404e7b9b1f5edc4d

Benefits

Security Considerations

References

Reference Implementations