{"id":"a202149201e2864f7f92441a6030692ea175b222e9e964cf499490d0c1db52fd","pubkey":"b22b06b051fd5232966a9344a634d956c3dc33a7f5ecdcad9ed11ddc4120a7f2","created_at":1786557181,"kind":30817,"tags":[["d","trusted-auth-relays"],["title","Trusted Auth Relays"],["alt","Nostr Implementation Possibility: Trusted Auth Relays"],["k","36205","Generic Lists"],["client","NostrHub"]],"content":"NIP Trusted Auth Relays\n======\n\n## Abstract\n\nAnswering a [NIP-42](https://github.com/nostr-protocol/nips/blob/master/42.md) `AUTH` challenge reveals the user's pubkey to the relay, but asking the user on every challenge is unusable, so most clients authenticate automatically.\n\nThis NIP defines a list of the relays the user trusts with their identity. Anything that handles `AUTH` challenges (client, extension, remote signer) can read this list and authenticate without prompting.\n\n## Event Definition\n\nThis list is a generic list named `trusted-auth-relays`.\n\n`[\"relay\", \"<relay-url>\"]`: a relay the user is willing to authenticate to without being asked. Matched against the relay URL after normalization; subdomains are NOT automatically trusted.\n\n```json\n{\n  \"kind\": 36205,\n  \"tags\": [\n    [\"d\", \"trusted-auth-relays\"],\n    [\"relay\", \"wss://relay.example.com/\"]\n  ],\n  \"content\": \"<nip-44 encrypted tags>\"\n}\n```\n\n## Client Behavior\n\nOn an `AUTH` challenge from a listed relay, the client MAY sign the `kind: 22242` event without prompting the user. Otherwise it MUST NOT authenticate silently: it SHOULD ask the user, or refuse.","sig":"e5eeff08a5c68cc858ca71506b595b0b26e6110b835ec6e97920196a9af6c7b241537ae39ce0237ecf835739a953f857fe718c098acd70992a2376cd8d2a0cfb"}