It involves generation of session keys by the app, and use of those temporary keys to talk to the signer (nsec.app) over some relay.
Bunker url is just a pointer to your npub and a relay over which app can talk to signer. But bunker url can also contain secret that has pre-approved permissions attached to it by the signer. Nsec.app doesn't support that atm.
Thanks for this explanation. Also, the collection of short video guides you are making seem like a really useful and necessary resource, thank you so much for doing that!
Thanks for using it and for the feedback!