So, the zapper zaps the zap request. You are not the zapper. The other person is not the zapper. The zapper has a well-known URL with you in it, but the pubkey isn’t your pubkey, it’s the zapper’s pubkey. The zapper isn’t a person. You zap the zapper and then the zapper zaps the person. You need the lud06 or lud16, the bolt11, and the lnurlp. The preimage is optional. The zapper CAN send fake zaps. You can’t trust the zapper. But you should always verify that zaps were signed by the zapper. Anyway