It’s fairly simple, just not a very clear spec.

Few implementation reminders to help you out:

- Client response starts with “AUTH” not “EVENT”

- When the client sends a REQ for a kind 4 DM, we will respond with an AUTH challenge. After successfully authenticating you MUST send the REQ again (at least with our implementation).

You can test the flow with inbox.nostr.wine now since I whitelisted your pubkey. Let me know if you need any help.