Yes, the tricky part is replay attacks. But maybe you can mitigate them using something like NWT https://github.com/pippellia-btc/nostr-web-tokens