yes, just send a signed event in an authentication header

if window.nostr is there, you can add a "sign in with nostr" button