fiatjaf on Nostr: I've once thought the "secret" was a secret and could be relied upon as an ...

I've once thought the "secret" was a secret and could be relied upon as an authorization token, but I realized that couldn't be it since most clients only called "connect" once with the secret, so it is de facto a nonce, the NIP should make this explicit. Someone please send a PR editing it.

On the other hand for https://viewsource.win/fiatjaf.com/promenade I didn't use a secret at all, instead the bunker URI has a random pubkey in it that isn't the actual user pubkey, so it can be used and reused as an authorization token, i.e. anyone with the bunker URI can connect. I think this is fine for most cases too.