Yeah. When identity is requisite to make the request, I'm not sure what else can be done? Other than a session I guess.
Discussion
Create a session token like JWT, easy to work with and only requires a single request. although I'm not sure if that would break NIP-98