NIP-98

HTTP Auth for Nostr
By Kieran (v0l) and Melvin Carvalho
Specification Original PR GitHub

What is NIP-98?

NIP-98 defines a method for authenticating HTTP requests using signed Nostr events. A client creates a kind 27235 event containing the target URL and HTTP method, signs it with their Nostr key, base64-encodes it, and sends it in the HTTP Authorization header. 

Authorization: Nostr <base64-encoded-signed-event>

This gives any HTTP server passwordless authentication tied to Nostr identities. No accounts, no sessions, no cookies — just cryptographic proof of identity.

How It Works

  1. Client creates a kind 27235 ephemeral event
  2. Event includes u tag (URL) and method tag (GET, POST, PUT, etc.)
  3. Optionally includes a payload tag (SHA-256 hash of the request body)
  4. Client signs the event and base64-encodes it
  5. Server validates the signature, URL, method, and timestamp (within a short window)

The timestamp check prevents replay attacks. The URL and method binding prevents token reuse across endpoints. No challenge-response is needed — the signed event is self-contained proof.

Ecosystem

NIP-98 is used across 115+ projects. Below are the most notable by category.

Libraries & SDKs

Server Middleware

Clients

Media & File Storage

Wallets & Payments

Relays

Streaming & Music

AI & Data Vending Machines

Git & Linked Data

Infrastructure & Hosting

CLI Tools

Key Management & Login

Other

W3C Specification

The W3C Nostr Community Group is formalizing the NIP-98 auth pattern as a W3C specification: HTTP Authentication Using Schnorr Signatures. This generalizes the approach beyond Nostr, enabling any HTTP service to authenticate requests using Schnorr signatures — including SSO, decentralized auth, and blockchain key integration.

Source  |  Draft specification  |  Solid CG proposal

Related: Blossom

Blossom (Blobs Stored Simply on Mediaservers) derives its auth from the NIP-98 pattern, adopting the Authorization: Nostr <base64> header scheme but using a distinct event kind (kind 24242) with server-agnostic scoping. Where NIP-98 binds auth to a specific URL, Blossom binds to an operation type, enabling the same auth event to work across multiple servers. See blossom#8 for the design rationale.

NosDAV

NosDAV is a distributed authoring and versioning protocol built on Nostr. It uses NIP-98 as its authentication layer for write operations, enabling WebDAV-like file storage with Nostr identities.

NosDAV apps include bookmarks, pastebin, todo, calendar, kanban, and mind maps.

History