Nice work! Amber looks great.

Question: If a web application doesn't sign events or decrypt anything is it possible to request only the read pubkey permission?

If so I'll definitely try to integrate with noswot.org so the app doesn't appear to request sign/decrypt permissions when they're not needed. 

 Yes, you can call the login without any permissions.

You can read more on how to implement for web apps in the usage for web applications section.

https://github.com/greenart7c3/Amber#usage-for-web-applications 

 Are there plans for nip46 in amber? 

 No, amber is a offline signer.
For nip 46 there's nostrum, but I haven't tried it

https://github.com/nostr-connect/nostrum 

 Thanks! and yes, in the example I just asked for all permissions but will update it so the user of Amber decides when to ask for permissions.