Okay this is more difficult than expected.
There's the NDK nip07signer that can get the npub
There's NDK events that can be signed
There's nip 98 for httpauth which is what I'm trying to do.
But making a signed ndk event need the nip07 signer which triggers 3 nos2x popups when it should just be one