Thinking out loud how we can easily support Nostr 402 (payment required) and 401 (unauthorised). Good news — I think we can just use a WWW-Authenticate header to indicate supported auth methods - which can double as a way to prove payment.

Basically, for 402 Payment Required, we can return a mime/type suitable response.

For an image we can return a blurred/masked image and maybe some kind of indicator it’s paywalled with two HTTP headers. An invoice header to optionally pay and a WWW-Authenticate with something like Nostr-NIP-98.

Doesn’t solve the issue of knowing if you’ve already paid. If you get 402, do you automatically try auth to see? Privacy issues exist. Do you try auth once before invoice payment as a sense check? Also doesn’t solve normal web browser inter-op. Maybe closer to an approach.. but lots to solve still.

One possible approach is to whitelist domains you are happy sending HTTP AUTH events for accessing the content - paid or private.