userAdityaa/caravel
1
1
Fork 0
forked from coracle/caravel
Code Pull Requests Activity

docs(auth): document intentional session-style NIP-98 model

Browse Source
This commit is contained in:
Aditya Chaudhary
2026-04-16 14:37:43 +05:45
parent 85d37f53ce
commit 57e21cf51d
5 changed files with 32 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/README.md
+5 -2
View File
@@ -51,8 +51,11 @@ npm run preview
## Authentication
- Tenant requests use NIP-98 tokens derived from the logged-in user
- Admin routes require a pubkey listed in `PLATFORM_ADMIN_PUBKEYS` on the backend
- Tenant requests use an intentional session-style variant of NIP-98:
- The client signs one kind `27235` event with `u = VITE_API_URL`.
- The resulting `Authorization` header is cached for about 10 minutes to avoid repeated signer prompts.
- The backend validates signer identity + host affinity rather than exact URL/method binding per request.
- Admin routes require a pubkey listed in `ADMINS` on the backend.
## Routes