nip98

Minimal zero-dependency NIP-98 library for HTTP Auth with Nostr.

Install

npm install nip98

Usage

Requires a NIP-07 signer (window.nostr).

import { getToken, authFetch } from 'nip98'

// Get an auth header
const auth = await getToken('https://api.example.com/data', 'GET')
// => "Nostr eyJraW5kIjoyNzIzNS..."

// Or use the fetch wrapper
const res = await authFetch('https://api.example.com/data')

// POST with body (auto-hashes payload)
const res = await authFetch('https://api.example.com/submit', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ name: 'alice' })
})

API

getToken(url, method, body?, signer?)

Returns Promise<string> — the Authorization header value ("Nostr <base64>").

• url — absolute URL of the request
• method — HTTP method
• body — optional request body (string or ArrayBuffer), used to compute the payload tag
• signer — optional NIP-07 signer, defaults to window.nostr

authFetch(url, options?, signer?)

Wraps fetch() with a NIP-98 Authorization header. Same signature as fetch plus optional signer.

parseToken(header)

Decodes an Authorization header value. Returns the parsed Nostr event object or null.

validateToken(event, url, method, windowSecs?)

Validates a parsed NIP-98 event against expected URL, method, and timestamp. Returns { valid: true } or { valid: false, error: string }.

Does not verify the cryptographic signature — use @noble/curves for that on the server side.

See Also

• nip98.com — project homepage
• SKILL.md — full implementation guide
• NIP-98 spec — canonical specification

License

MIT