Background

Nostr uses secp256k1 keypairs for identity. A did:nostr:<pubkey> could serve as a decentralized WebID without requiring an HTTP-hosted identity document.

What Would Be Needed

Client (solid-oidc.js)

• Already accepts any webid claim - minimal changes needed
• May need DID resolution if dereferencing the WebID

IDP (Server)

A Nostr-OIDC bridge that:

1. Presents a challenge (random nonce)
2. User signs with their Nostr private key (nsec)
3. Bridge verifies signature against public key (npub)
4. Issues standard OIDC tokens with webid: "did:nostr:<pubkey>"

Possible Approaches

1. Patch existing IDPs (CSS, JSS) - add Nostr auth flow
2. Standalone Nostr-OIDC bridge - minimal service that speaks OIDC but authenticates via Nostr
3. Client-side DPoP with Nostr keys - skip OIDC, use Nostr keys directly for DPoP

Questions

• Should the webid be did:nostr:<npub> or did:nostr:<hex-pubkey>?
• How to handle DID document resolution?
• Could NIP-05 identifiers map to WebIDs?

References

• DID Nostr Method (if formalized)
• Solid-OIDC Spec
• Nostr NIP-07 - browser extension signing