My new framework called blossy is perfect for building that. Auth is not well implemented because blossom Auth is insecure and currently being rebuilt. I'll add support for Nostr Web Tokens tomorrow...