diff --git a/42.md b/42.md
index 8c70de4..53af82f 100644
--- a/42.md
+++ b/42.md
@@ -6,7 +6,7 @@ Authentication of clients to relays
 
 `draft` `optional`
 
-This NIP defines a way for clients to authenticate to relays by signing an ephemeral event.
+This NIP defines a way for clients to authenticate to relays by signing an ephemeral event and a way to specify which events and private and MUST require authentication to be served.
 
 ## Motivation
 
@@ -18,6 +18,40 @@ A relay may want to require clients to authenticate to access restricted resourc
 
 ## Definitions
 
+### New field to identify private events
+
+Clients that want to force an authentication in any event can add a `requires_auth_by` with array of authorized pubkeys to the base event object. 
+
+```jsonc
+{
+  "id": <32-bytes lowercase hex-encoded sha256 of the serialized event data>,
+  "pubkey": <32-bytes lowercase hex-encoded public key of the event creator>,
+  "requires_auth_by" [<32-bytes lowercase hex-encoded public key>, ... ]
+  "created_at": <unix timestamp in seconds>,
+  "kind": <integer between 0 and 65535>,
+  "tags": [
+    [<arbitrary string>...],
+    // ...
+  ],
+  "content": <arbitrary string>,
+  "sig": <64-bytes lowercase hex of the signature of the sha256 hash of the serialized event data, which is the same as the "id" field>
+}
+```
+
+NIP-42 supporting relays must then include the `requires_auth_by` field as the 7th position in the serialization of the event. This guarantees that relays and clients that do not support this NIP cannot validate private events and will never be able to receive them, avoiding leaking the event structure to a public relay. 
+
+```js
+[
+  0,
+  <pubkey, as a lowercase hex string>,
+  <created_at, as a number>,
+  <kind, as a number>,
+  <tags, as an array of arrays of non-null strings>,
+  <content, as a string>,
+  <requires_auth_by, as an array of non-null strings> 
+]
+```
+
 ### New client-relay protocol messages
 
 This NIP defines a new message, `AUTH`, which relays CAN send when they support authentication and clients can send to relays when they want to authenticate. When sent by relays the message has the following form: