NIP-96 describes an HTTP file storage integration intended to work alongside Nostr.
What it standardizes
It separates file upload and retrieval from WebSocket relay traffic. The broader point is that media storage can be adjacent to Nostr rather than inside every relay.
- Protocol layer. NIP-96 is not a consumer product. It is a convention that clients, relays or adjacent services may choose to support.
- Interoperability. The value is not that every app looks the same. The value is that different apps can understand the same signed data.
- Optionality. NIPs are implementation possibilities. Builders should implement the pieces that serve their product, security model and user journey.
Implementation notes
A storage server exposes HTTP endpoints. Clients upload media and then reference resulting URLs through Nostr events.
- Client responsibility. Clients need to explain the feature clearly because the user sees an experience, not a spec.
- Relay responsibility. Relays may support only the parts that fit their storage, moderation, authentication and business model.
- Indexing responsibility. Search, discovery and context often require extra indexers or opinionated clients on top of the raw protocol.
Crays relevance
Crays can combine storage, file metadata and content access for creator media without forcing relays to become general media hosts.
- Crays.net. Profiles, creator pages and social proof need portable identity rather than a closed account table.
- Crays World. Real venues need local context, member state, reputation and payments that can survive app changes.
- DAO path. Future governance needs signed identity, membership context and auditable participation signals.
Risks and design discipline
The NIP is marked unrecommended in favor of newer work, so production systems should verify current status before committing to it.
- Do not overpromise. A NIP gives a shared format. It does not magically solve onboarding, moderation, UX or custody.
- Keep the private key away. Any feature that increases private-key exposure increases the attack surface.
- Use plain language. Most users need outcomes: login, pay, publish, vote, prove status, access a venue.