cameri · Justxd22 · Jul 8, 2026
diff --git a/.changeset/cool-ways-brake.md b/.changeset/cool-ways-brake.md
@@ -0,0 +1,5 @@
+---
+"nostream": minor
+---
+
+Replace admin password login with NIP-98 HTTP auth kind-27235 `Authorization: Nostr` headers verified against an `admin.pubkeys` allowlist
diff --git a/README.md b/README.md
@@ -65,6 +65,7 @@ NIPs with a relay-specific implementation are listed here.
 - [x] NIP-45: Event Counts
 - [x] NIP-62: Request to Vanish
 - [x] NIP-65: Relay List Metadata
+- [x] NIP-98: HTTP Auth (admin console login)
 
 ## Requirements
 

diff --git a/package.json b/package.json
@@ -25,7 +25,8 @@
     44,
     45,
     50,
-    65
+    65,
+    98
   ],
   "supportedNipExtensions": [],
   "supportedMips": [

diff --git a/resources/admin-dashboard.html b/resources/admin-dashboard.html
@@ -0,0 +1,74 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>Admin - {{name}}</title>
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css" integrity="sha384-rbsA2VBKQhggwzxH7pPCaAqO46MgnOM80zW1RWuH61DGLwZJEdK2Kadq2F9CUG65" crossorigin="anonymous">
+    <link rel="stylesheet" href="{{path_prefix}}/css/style.css">
+  </head>
+  <body lang="en" data-path-prefix="{{path_prefix}}">
+    <main class="container">
+      <div class="row">
+        <div class="col">
+          <h1 class="mt-4 mb-2 text-center text-nowrap">{{name}}</h1>
+        </div>
+      </div>
+      <div class="row">
+        <div class="col text-center mb-4">
+          <p class="text-muted">Relay Administration</p>
+        </div>
+      </div>
+
+      <div class="row justify-content-center">
+        <div class="col col-md-8 col-lg-5">
+
+          <div class="card mb-4">
+            <div class="card-body text-center">
+              <h5 class="card-title">Admin Console</h5>
+              <p class="card-text">You are signed in with NIP-98.</p>
+              <p id="session-info" class="text-muted small"></p>
+              <button id="logout" type="button" class="btn btn-outline-secondary w-100">Sign out</button>
+            </div>
+          </div>
+
+          <div class="d-flex justify-content-center gap-3 mt-2 mb-5">
+            <a href="{{path_prefix}}/" class="text-muted small">Back to relay</a>
+          </div>
+
+        </div>
+      </div>
+    </main>
+    <script nonce="{{nonce}}">
+      // Check for system preference on load
+      if (window.matchMedia('(prefers-color-scheme: dark)').matches) {
+        document.body.classList.add('dark-theme');
+      }
+
+      (() => {
+        const pathPrefix = document.body.dataset.pathPrefix || ''
+        const sessionInfo = document.getElementById('session-info')
+        const logoutButton = document.getElementById('logout')
+
+        fetch(`${pathPrefix}/admin/session`, { credentials: 'same-origin' })
+          .then((response) => (response.ok ? response.json() : undefined))
+          .then((session) => {
+            if (session && typeof session.expiresAt === 'number') {
+              sessionInfo.textContent = `Session expires ${new Date(session.expiresAt * 1000).toLocaleString()}.`
+            }
+          })
+          .catch(() => undefined)
+
+        logoutButton.addEventListener('click', async () => {
+          logoutButton.disabled = true
+          try {
+            await fetch(`${pathPrefix}/admin/logout`, { method: 'POST', credentials: 'same-origin' })
+          } catch (error) {
+            // ignore and send the operator back to the login page
+          }
+          location.assign(`${pathPrefix}/admin/login`)
+        })
+      })()
+    </script>
+  </body>
+</html>
diff --git a/resources/admin-login.html b/resources/admin-login.html
@@ -0,0 +1,117 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>Admin Login - {{name}}</title>
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css" integrity="sha384-rbsA2VBKQhggwzxH7pPCaAqO46MgnOM80zW1RWuH61DGLwZJEdK2Kadq2F9CUG65" crossorigin="anonymous">
+    <link rel="stylesheet" href="{{path_prefix}}/css/style.css">
+  </head>
+  <body lang="en" data-path-prefix="{{path_prefix}}">
+    <main class="container">
+      <div class="row">
+        <div class="col">
+          <h1 class="mt-4 mb-2 text-center text-nowrap">{{name}}</h1>
+        </div>
+      </div>
+      <div class="row">
+        <div class="col text-center mb-4">
+          <p class="text-muted">Relay Administration</p>
+        </div>
+      </div>
+
+      <div class="row justify-content-center">
+        <div class="col col-md-8 col-lg-5">
+
+          <div class="card mb-4">
+            <div class="card-body text-center">
+              <h5 class="card-title">Admin Login</h5>
+              <p class="card-text">
+                Sign in with your Nostr identity. Your signer extension or connected
+                wallet (NIP-07) will be asked to sign a NIP-98 authentication event.
+              </p>
+              <button id="sign-in" type="button" class="btn btn-warning w-100">Sign in with Nostr</button>
+              <p id="status" class="mt-3 mb-0" role="status"></p>
+              <p id="no-extension" class="text-muted small mt-3 mb-0 hidden">
+                No NIP-07 signer detected. Install a Nostr signer extension such as
+                Alby or nos2x, or open this page from a wallet with a built-in signer,
+                then reload this page.
+              </p>
+            </div>
+          </div>
+
+          <div class="d-flex justify-content-center gap-3 mt-2 mb-5">
+            <a href="{{path_prefix}}/" class="text-muted small">Back to relay</a>
+          </div>
+
+        </div>
+      </div>
+    </main>
+    <script nonce="{{nonce}}">
+      // Check for system preference on load
+      if (window.matchMedia('(prefers-color-scheme: dark)').matches) {
+        document.body.classList.add('dark-theme');
+      }
+
+      (() => {
+        const pathPrefix = document.body.dataset.pathPrefix || ''
+        const loginUrl = `${location.origin}${pathPrefix}/admin/login`
+        const signInButton = document.getElementById('sign-in')
+        const status = document.getElementById('status')
+
+        const setStatus = (message, isError) => {
+          status.textContent = message
+          status.className = isError ? 'mt-3 mb-0 text-danger' : 'mt-3 mb-0'
+        }
+
+        if (!window.nostr || typeof window.nostr.signEvent !== 'function') {
+          signInButton.disabled = true
+          document.getElementById('no-extension').classList.remove('hidden')
+          return
+        }
+
+        signInButton.addEventListener('click', async () => {
+          signInButton.disabled = true
+          setStatus('Waiting for your signer to approve…', false)
+
+          try {
+            const signedEvent = await window.nostr.signEvent({
+              kind: 27235,
+              created_at: Math.floor(Date.now() / 1000),
+              tags: [
+                ['u', loginUrl],
+                ['method', 'POST'],
+              ],
+              content: '',
+            })
+
+            const response = await fetch(loginUrl, {
+              method: 'POST',
+              credentials: 'same-origin',
+              headers: {
+                Authorization: `Nostr ${btoa(JSON.stringify(signedEvent))}`,
+              },
+            })
+
+            if (response.ok) {
+              setStatus('Signed in. Redirecting…', false)
+              location.assign(`${pathPrefix}/admin`)
+              return
+            }
+
+            setStatus(
+              response.status === 401
+                ? 'Login rejected. Your pubkey isn\'t allowed.'
+                : 'Login failed. Please try again.',
+              true,
+            )
+          } catch (error) {
+            setStatus('Signing was cancelled or failed.', true)
+          }
+
+          signInButton.disabled = false
+        })
+      })()
+    </script>
+  </body>
+</html>
diff --git a/resources/default-settings.yaml b/resources/default-settings.yaml
@@ -250,3 +250,4 @@ limits:
 admin:
   enabled: false
   sessionTtlSeconds: 86400
+  pubkeys: []
diff --git a/src/@types/admin.ts b/src/@types/admin.ts
@@ -2,6 +2,14 @@ import { Request, Response } from 'express'
 
 export interface IAdminAuthProvider {
   handleLogin(request: Request, response: Response): Promise<void>
-  isRequestAuthenticated(request: Request): boolean
+  isRequestAuthenticated(request: Request): Promise<boolean>
   getSessionExpiresAt(request: Request): number | undefined
 }
+
+export interface INip98ReplayGuard {
+  /**
+   * Returns true when eventId was not seen before (and is now registered),
+   * false when the event id is being replayed.
+   */
+  registerEventId(eventId: string, ttlSeconds: number): Promise<boolean>
+}
diff --git a/src/@types/settings.ts b/src/@types/settings.ts
@@ -281,8 +281,17 @@ export interface Nip05Settings {
 
 export interface AdminSettings {
   enabled: boolean
-  passwordHash?: string
+  /**
+   * NIP-98 admin allowlist: 64-char hex pubkeys or npub1... entries.
+   * Empty or unset means no one can authenticate.
+   */
+  pubkeys?: string[]
   sessionTtlSeconds?: number
+  /**
+   * Maximum allowed |now - created_at| for NIP-98 auth events, in seconds.
+   * Defaults to 60 when unset.
+   */
+  authTimestampToleranceSeconds?: number
 }
 export interface WoTSettings {
   enabled: boolean
-Original file line number
+Diff line change
@@ Expand Up / @@ -25,7 +25,8 @@ @@
 ,
 ,
 ,
+,
       ],
       "supportedNipExtensions": [],
       "supportedMips": [
@@ Expand Down @@