Sorry, saw the configuration in the file. Can whitelist

// For personal usage. Leaving this empty allows everyone to use this bostr instance.
  // NOTE: Requires NIP-42 on client.
  authorized_keys: [
    // "pubkey-in-hex",
    // "npub ....",
    // ....
  ],