NIP-98 defines a method for authenticating HTTP requests using signed Nostr events.
A client creates a kind 27235 event containing the target URL and HTTP method,
signs it with their Nostr key, base64-encodes it, and sends it in the HTTP
Authorization header.
This gives any HTTP server passwordless authentication tied to Nostr identities.
No accounts, no sessions, no cookies — just cryptographic proof of identity.
How It Works
Client creates a kind 27235 ephemeral event
Event includes u tag (URL) and method tag (GET, POST, PUT, etc.)
Optionally includes a payload tag (SHA-256 hash of the request body)
Client signs the event and base64-encodes it
Server validates the signature, URL, method, and timestamp (within a short window)
The timestamp check prevents replay attacks. The URL and method binding prevents
token reuse across endpoints. No challenge-response is needed — the signed
event is self-contained proof.
Ecosystem
NIP-98 is used across 115+ projects. Below are the most notable by category.
Libraries & SDKs
nostr-toolsJS/TS — canonical Nostr library; nip98.getToken() and nip98.validateToken()
NDKJS/TS — Nostr Development Kit used by many downstream clients
WelshmanJS/TS — Nostr toolkit from Coracle with Nip98.ts module
The W3C Nostr Community Group is formalizing
the NIP-98 auth pattern as a W3C specification:
HTTP Authentication Using Schnorr Signatures.
This generalizes the approach beyond Nostr, enabling any HTTP service to authenticate
requests using Schnorr signatures — including SSO, decentralized auth, and
blockchain key integration.
Blossom (Blobs Stored Simply on Mediaservers)
derives its auth from the NIP-98 pattern, adopting the
Authorization: Nostr <base64> header scheme but using a distinct
event kind (kind 24242) with server-agnostic scoping. Where NIP-98 binds
auth to a specific URL, Blossom binds to an operation type, enabling the same
auth event to work across multiple servers. See
blossom#8 for the design rationale.
NosDAV
NosDAV is a distributed authoring and versioning protocol
built on Nostr. It uses NIP-98 as its authentication layer for write operations,
enabling WebDAV-like file storage with Nostr identities.
