The create-account flow is described here: https://github.com/kind-0/nsecbunkerd/blob/master/OAUTH-LIKE-FLOW.md

Client (or nostr-login library) fetches nsec.app/.well-known/nostr.json, learns the npub and relay (of the nsec.app server - not the user), sends 'create_account' over NIP46, receives auth_url and shows the popup. Account is created by the auth_url tab (nsec.app or other nsecbunker). 

The code for all this is scattered over nostr-login, noauth and noauthd repos at github.com/nostrband