SASL EXTERNAL is an alternative to password authentication which uses a certificate that is registered (by the user) with the IRC server.

For this configuration, we will be referencing https://libera.chat/guides/certfp. The concepts should be similar for every server, but be sure to check your desired server's website for specific instructions.

Libera provides generic instructions on certificate generation using OpenSSL.

Once you have the PEM file, you can place it somewhere safe on your machine.

Within your tiny config file, you will need to add the path to your PEM certificate under sasl

Ex.

# ... omitted fields
- addr: irc.libera.chat
  port: 6697
  tls: true
  # ... omitted fields
  sasl:
    username: tiny_user
    # password: "hunter2"
    pem: "/home/me/.config/tiny/libera.pem" # <-- Change to where your PEM file is

Once you launch tiny, you can now follow the Libera instructions to automatically identify with NickServ every time tiny starts.