Oddbean new post about | logout
 I don't think it makes sense to remove the mandatory "u" tag from NIP-98 events. The "u" tag restricts the event (auth token) to a single endpoint and allows the user to know specifically what endpoint they are allowing the client to call on their behalf.
Removing the mandatory "u" tag would turn NIP-98 into a generic "HTTP authentication" method. and while it would allow the client to talk to multiple servers, I don't think that's a good thing.

Blossom has a "generic authentication" event because the user is "publishing a blob to wider internet" similar to how users sign nostr events and publish them to multiple relays. each relay doesn't require a separate signature because they are interchangeable and their purpose it to host the users events.

NIP-98 on the other hand is a authorization for a client to perform an action on a specific server on their behalf. and while NIP-96 uses it to upload files I don't view it the same as publishing.