Now You Can Access The Håkon Without Sharing Your Private Key

One of the most common concerns among Nostr users is having to provide their private key (nsec) to access certain services. This concern is well-founded: the private key gives you control over your identity on the network, and if compromised, it could allow third parties to publish content and perform actions on your behalf.

With this in mind, The Håkon now offers a new authentication method, available under the Advanced option on the login screen. This allows users to access the platform through a signing app, such as Amber for Android, without having to provide their private key to the website.

The process is straightforward. The private key remains securely stored in the signing app, which is responsible for authorizing and signing operations requested by The Håkon. When publishing an article, leaving a comment, or liking a post, for example, the platform sends a request to the app, which signs the operation according to the permissions granted by the user.

The integration uses NIP-46, a Nostr protocol that enables communication between applications and remote signers. Although Amber is one of the most widely known options, any signing app compatible with this standard can be used.

How It Works

There are two ways to establish a connection.

The first uses an address beginning with bunker://, generated by the signing app. Simply copy this address and paste it into the corresponding field on The Håkon to initiate the connection.

The second allows users to start authentication directly through the option to sign in with a signing app. On mobile devices, the compatible app can open automatically. On a computer, a QR code is displayed and can be scanned with a smartphone. Once authorized, the connection is established, and the user can start using the platform.

In both cases, the private key remains within the signing app and never needs to be shared with The Håkon.

To maintain communication, the browser stores a session key used to connect with the signer. This key does not replace the user's Nostr identity or, by itself, grant access to the main private key. Connection permissions can be managed according to the features provided by the signing app.

This approach also provides greater control over authorized operations. Depending on the signer's settings, each action may require individual approval or be automatically authorized after persistent permissions have been granted.

The traditional options of creating a Persona directly on The Håkon or importing an nsec private key remain available. The new integration expands the available authentication methods, offering an alternative for users who prefer to keep their private keys under the control of a dedicated signing app.

With this new feature, The Håkon takes another step toward making content publishing on the network more accessible while preserving users' autonomy over their digital identities.