Nostr WoT

For client and SDK developers

Bring your client into the passkey ecosystem

Help people use their existing Nostr identity in your app. Request a compatibility review and agree a safe integration path.

Request an integrationRead the technical guide

Opens a public GitHub form in a new tab. A GitHub account is required.

Integration support is under review. A request does not grant access or guarantee compatibility.

Choose the access your app needs

Connect a signer

Request signing operations while identity keys remain in the user’s signer. Use a supported signer protocol when your app does not need the keys.

Recover with a passkey

Your client receives key material and may open a whole vault. This needs explicit consent, compatible recovery formats and source-owner approval for cross-origin access.

What to bring

  • Your project, public code or documentation, and a maintainer contact.
  • Exact production and staging origins, the source RP domain, and the direction of access.
  • The user journey, which secrets your client sees, what it stores, and how logout and recovery work.
  • Implementation versions, supported browsers/devices, disposable-account test results and a pilot plan. Mark untested cases.

From request to tested support

  1. Submit your request

    Describe your integration in the GitHub form. Keep confidential information out of the public issue.

  2. Review compatibility and access

    Maintainers review formats, secret scope and exact origins with you. Both the source and receiving client have work to do.

  3. Test, pilot, then enable

    Verify recovery on supported devices, agree a limited pilot and record compatible versions before enabling access.

A supported source is more than a name

Each passkey request targets one RP domain. Listing a source does not authorize it. Browser support, source permission and recovery compatibility must all be verified; native app associations are separate.

Keep recovery data private

Never post seeds, private keys, PRF outputs, tokens, credential IDs or personal vaults. Use private security reporting for vulnerabilities or sensitive security details.

Report privately on GitHub
Read the technical guide