cool! Is the auth private, or do I need to sign something with a whitelisted npub?