1# 🥇 gold.js - relay AUTH23gold.js is a miniature NIP-42 client: it answers a relay's `AUTH` challenge with a signed kind 22242 event, so members-only relays let you read and publish. When a relay refuses a subscription or an event with `auth-required:`, gold authenticates once and re-sends it, and xenon never sees the refusal. It composes through xenon's `nhy:message` event and the `nhy:config` signing hook, so helium.js, chlorine.js or a NIP-07 extension signs the AUTH event just as it signs posts.45```html6<script src="helium.js"></script>7<script src="gold.js"></script>8<script src="xenon.js"></script>910<ol nhy-relay="wss://private.example" nxe-filter='{"kinds":[1]}'></ol>11<form nhy-relay="wss://private.example" nxe-publish><input name="content"><button>Post</button></form>12```1314The relay refuses the list's subscription until you prove who you are, so gold signs its challenge and asks again, and the notes appear.1516## Attributes1718| attribute | description |19|---|---|20| `nau-eager` | On `<html>` or `<body>`: authenticate as soon as a relay sends a challenge, not only when it refuses something |21| `nau-relays` | On any element: space-separated relays that may receive AUTH. Others are never answered. Default any relay that asks |2223`window.nauCfg = {eager, relays}` sets the same options from script.2425## Events2627Dispatched on `document`.2829| event | cancel to | detail |30|---|---|---|31| `nau:auth` | skip authenticating (the refusal then reaches xenon) | `url`, `challenge`, `cfg` with the unsigned `event`, before signing. To choose a different signer, set `cfg.sign` in `nhy:config` like every nobel signer |32| `nau:authed` | | `url`, `pubkey` once the relay says OK |33| `nau:error` | | `url`, `error`: refused, cancelled, no challenge within 3 s, or (from `gold.auth`) a relay not in `nau-relays` |3435## API3637| function | returns |38|---|---|39| `gold.auth(url)` | Promise of your pubkey once authenticated on that relay's current connection (connects if needed) |40| `gold.state[url]` | `{challenge, pubkey, ...}` for the current connection. A reconnect starts fresh |4142Each connection gets at most one AUTH, and each refused subscription or event is retried once. If the relay still refuses, the refusal reaches xenon, so the publish reports `ok:false`.4344Privacy: gold is lazy by default and only authenticates when a relay refuses something. Each AUTH tells that relay which pubkey is connecting, so eager mode tells every relay you connect to. Use `nau-relays` to limit which relays get it.