diff --git a/backend/src/routes/auth.ts b/backend/src/routes/auth.ts
index d0d3561..986f438 100644
--- a/backend/src/routes/auth.ts
+++ b/backend/src/routes/auth.ts
@@ -20,12 +20,12 @@ router.post("/login-npub", (req: Request, res: Response) => {
     return;
   }
   try {
-    const decoded = nip19.decode(raw);
-    if (decoded.type !== "npub") {
+    const decoded = nip19.decode(raw) as { type: string; data: unknown };
+    if (decoded.type !== "npub" || typeof decoded.data !== "string") {
       res.status(400).json({ code: "invalid_npub", message: "Expected an npub-encoded public key." });
       return;
     }
-    const pubkey = decoded.data as string;
+    const pubkey = decoded.data;
     const token = signJwt(pubkey, "npub");
     res.json({ token, pubkey, method: "npub" });
   } catch {