NIP-47? It doesn’t really help in this case because all cashu-address endpoints are NIP-98 protected, so you need to sign every request anyways.

There is no other auth layer but nostr, which is what makes it so awesome IMO.