@sophia Prosody is probably your best bet since lua scripting is a thing (erlang hacking requires some extraterrestrial experience). It already has a custom http auth module and writing a different one should not require more than one or two linea of code: https://modules.prosody.im/type_auth.html
Also I must intervene and suggest you take a look at Matrix, which is a very nice alternative to XMPP.
@kaiyou Thank you, that seems to be the route she's looking to go with now! I believe she's set on xmpp, but it's looking a lot more promising with some things people have advised with 😊
The social network of the future: No ads, no corporate surveillance, ethical design, and decentralization! Own your data with Mastodon!