From e81a8b7fb920de1827fd17357932a86a52c5ccfa Mon Sep 17 00:00:00 2001 From: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com> Date: Sun, 9 Aug 2026 10:54:25 -0500 Subject: [PATCH] docs(nips): align client assertion transport Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com> --- docs/nips/NIP-FI.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/nips/NIP-FI.md b/docs/nips/NIP-FI.md index d7958f728..b7395f73b 100644 --- a/docs/nips/NIP-FI.md +++ b/docs/nips/NIP-FI.md @@ -49,7 +49,7 @@ Two transport profiles are defined. A service MUST advertise and accept only pro ### Client-attached profile -This profile's discovery identifier is `client-attached`. The client sends exactly one `Nostr-Federated-Identity: Bearer ` field and no assertion-provenance field. A documented WebSocket profile MAY use `Authorization: Bearer`, but a NIP-98 HTTP request MUST reserve `Authorization` for its `Nostr` proof. Missing, repeated, comma-combined, malformed, empty, non-Bearer, or mixed-profile assertion fields are rejected. +This profile's discovery identifier is `client-attached`. The client sends exactly one `Nostr-Federated-Identity: Bearer ` field and no assertion-provenance field. The same field is used on WebSocket upgrades and NIP-98 HTTP requests; `Authorization` remains reserved for the Nostr proof where that protocol requires it. Missing, repeated, comma-combined, malformed, empty, non-Bearer, or mixed-profile assertion fields are rejected. ### Trusted-proxy HMAC profile