Is there a way for clients post as someone without having the account's secret #Nostr key? Perhaps using some kind of derivative key that can be revoked?

I'm writing a client and I really do not want to store NSECs 😐

For example #Bluesky and #Mastodon allow one to generate an API key for such use cases.

I know Nostr works totally different. Just curious if I'm overlooking something. nostr:npub1gcxzte5zlkncx26j68ez60fzkvtkm9e0vrwdcvsjakxf9mu9qewqlfnj5z?