Surmount Services

surmount.systemsOperator console
Stalwart unknown

Login

Nostr login

Auth mode=nostr: NIP-98 + session cookie (rust-nostr, not JS NDK). Empty allowlist is fail-closed. nsec never on server. Host enable: docs/OPS.md. Open residual (do not invent here): key-loss recovery, durable session store, first-operator bootstrap UX.

Mode: nostr · services host services.surmount.systems

Product auth uses rust-nostr on the server (not JS NDK / no NPM). nsec never leaves your client.

Optional: browser extension implementing window.nostr.signEvent.

curl / NIP-98

  1. GET /api/v1/auth/challenge for absolute u URL and skew window.
  2. Sign kind 27235 with tags u = session URL and method = POST.
  3. POST /api/v1/auth/session with header Authorization: Nostr <base64(event JSON)> (or JSON body {{"event": ...}}).

Allowlist: SURMOUNT_NOSTR_ALLOWLIST (npub or hex). Empty allowlist = fail-closed. Session sets CSRF cookie; cookie-authenticated POSTs need X-CSRF-Token.